Examkin

Question

Difficulty: Very hardWindows Security Settings and User Account Control

A desktop technician is troubleshooting a legacy 32-bit line-of-business application on a Windows 11 Pro workstation. When a standard user runs the application, configuration changes are saved without issue. However, when an administrative user logs in and opens the application normally (without selecting 'Run as administrator'), the application fails to save changes and throws a permission denied error. An inspection reveals that the application attempts to write settings to C:\Program Files (x86)\LegacyApp\config.ini, where NTFS permissions grant Write access exclusively to the local Administrators group. Which of the following best explains why the application saves configuration changes for the standard user but fails for the administrator?

  1. User Account Control file virtualization redirects writes to a user-specific VirtualStore directory for standard user tokens, but UAC virtualization is disabled for accounts belonging to the Administrators group.Answer
  2. B
    Standard user tokens dynamically inherit share permissions over local file directories when running legacy software, overriding local NTFS access control lists.
  3. C
    Launching legacy applications from standard user accounts automatically triggers silent background elevation via the Windows Local Security Policy snap-in.
  4. D
    Windows 11 automatically forces standard user accounts to execute 32-bit executables in compatibility mode, which bypasses kernel-level security descriptors.

Answer

User Account Control (UAC) file virtualization intercepts and redirects write attempts to protected system locations like Program Files for standard users into %LOCALAPPDATA%\VirtualStore. However, for administrative accounts operating under Admin Approval Mode, UAC file and registry virtualization is disabled, so direct write attempts to protected directories fail when the application is launched without full administrative privilege elevation.
User Account Control (UAC) includes a legacy compatibility mechanism called file and registry virtualization. When a 32-bit legacy application run by a standard user attempts to write to protected system directories like C:\Program Files (x86), Windows transparently redirects the write operation to %LOCALAPPDATA%\VirtualStore. However, for security and data integrity reasons, UAC virtualization is explicitly disabled for members of the local Administrators group. When an administrator launches the application without elevating ('Run as administrator'), the process runs with a filtered standard user token, but because virtualization is disabled for admin accounts, the direct write attempt to the protected folder is blocked by NTFS permissions.

Step-by-Step Solution

1
Analyze how User Account Control (UAC) handles legacy 32-bit applications writing to protected system directories.
Identify that 32-bit legacy applications writing to C:\Program Files (x86) trigger UAC virtualization for standard users, seamlessly redirecting writes to %LOCALAPPDATA%\VirtualStore.
UAC includes virtualization technology to prevent legacy applications from failing when attempting to write to system-protected file and registry locations.
2
Evaluate the behavior of UAC Admin Approval Mode for accounts in the local Administrators group.
Recognize that UAC disables file and registry virtualization for administrative accounts to prevent split-token inconsistencies.
Administrators are expected to run software with proper elevated privileges rather than relying on VirtualStore redirection.
3
Compare the execution state of the standard user token versus the unelevated administrator token.
The standard user succeeds due to VirtualStore redirection, while the unelevated administrator fails because virtualization is inactive and the token lacks elevated NTFS write rights.
Without explicit privilege elevation ('Run as administrator'), the administrator's filtered token cannot write directly to C:\Program Files (x86), causing the operation to fail.

Key Concept

UAC File and Registry Virtualization Behavior
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic