Two-level authentication mechanism

When UAC protection was first introduced in Windows Vista, all privilege elevation requests that were initiated and processed by RAiLaunchAdminProcess needed to pop up the consent.exe screen to indicate whether to elevate or not and then create the privilege elevation child process.

However, this mechanism was too annoying. As a result, the UAC protection in Windows 7 onward has been designed with two levels of trust privilege elevation authentication. This means that there are two levels of authentication—if a privilege request is passed with both levels of authentication, then the UAC interface will not pop up when consent.exe is called to ask whether the user is authorized and will automatically agree to the privilege elevation process creation request. This means that when a trusted process is called, consent.exe will still wake up, but the user approval request window will not pop up.

In this section, we will introduce the authentication...