Skip to content

Windows Integrity Architecture

Integrity Levels

  • Windows' Integrity Levels implement a mandatory access control (MAC) policy, where access decisions are not at the discretion of the object owner but are enforced by the system based on predefined integrity levels.

  • Integrity Levels represent the attributed trustworthiness of an entity or object:

    • Low integrity (S-1-16-4096)
    • Medium integrity (S-1-16-8192) 4 - Standard users typically receive this level. Objects without an integrity label are treated as medium integrity.
    • High integrity (S-1-16-12288) 4 - Elevated users receive this level.
    • System integrity (S-1-16-16384) 4 - System services typically receive this level.

  • Security subjects (such as users) and securable objects (such as files and processes) are assigned an integrity level.

  • When a write operation occurs, Windows first checks if the subject's integrity level "dominates" the object's integrity level. "Dominates" means the subject's integrity level is equal to or higher than the object's integrity level. If this condition is met, and the normal DACL check also succeeds, the write operation is granted.
  • This enforcement means that a subject can only write to objects at its same or lower integrity level, even if the object's DACL would otherwise allow write access. It helps prevent less trusted (lower integrity) processes from contaminating more trusted (higher integrity) data or processes.
  • The same restriction applies to reading. To read or write another process's memory, a thread must first obtain a handle to that process using the OpenProcess function. When a thread attempts to open a handle, the subject’s integrity level must usually dominate (be equal to or higher than) the object’s integrity level.

Practical Example: Web Browser Sandboxing

When you run a web browser (like Chrome or Edge) in "Protected Mode" or sandbox mode:

  • The browser process runs at Low Integrity Level.
  • Standard user files and registry keys are at Medium Integrity Level.

If a web page exploits a browser vulnerability, the malicious code inherits the browser's Low IL.

Because Windows blocks write-up attempts, the Low IL process is strictly forbidden from writing to Medium IL locations (like your Document folder) or High IL locations (like System32).

Integrity level of a process

  • Integrity levels are represented by integrity SIDs (Security Identifiers).
  • The integrity SID for a security subject (user) is stored in its access token. The integrity SID for a securable object (process, file) is stored in its System Access Control List (SACL) within an Access Control Entry.
  • Processes created by a user inherit the minimum of the user's integrity level and the executable file's integrity level, ensuring they never run with higher integrity than the executable.
  • Integrity levels are assigned at the time of process creation and remain static throughout the life of that process. If a process needs to perform tasks requiring a higher integrity level, it must typically launch a new process with an elevated token.

The Standard Elevation Path (UAC)

The most common way to achieve a higher integrity level is through User Account Control (UAC).

  • Developers mark an application's manifest with a requestedExecutionLevel of requireAdministrator.
  • When a standard user process calls the ShellExecute function to launch such a file, the system detects that elevation is required and the user is prompted for administrator credentials; if the user is an administrator, the user is prompted with a consent prompt.
  • Once approved, a new process is created which carries a High integrity level.

"Bypassing" Immediate UAC Prompts

While there isn't a simple "IncreaseIntegrityLevel" system call for an existing process, there are specific models and APIs used to perform higher-integrity tasks from a lower-integrity environment:

  • Administrator COM Object Model: An application can use the COM Elevation Moniker to create an elevated COM object. While this still triggers a UAC prompt, it allows a standard-user process to execute specific administrative methods via the elevated object.
  • Operating System Service Model: A standard process can communicate with a service already running as SYSTEM (the highest integrity level) via Remote Procedure Call (RPC. Because the service is already running at a high privilege level, no elevation prompt is required for the communication itself.
  • Elevated Task Model: An application can start a scheduled task that has been pre-configured to run as SYSTEM. If the task's security descriptor allows a standard user to start it, the process runs at a high integrity level without a UAC prompt at the time of execution.

High-integrity processes may lower their own integrity level (e.g., for sandboxing) with the SetTokenInformation API. This API does not allow a low-integrity process to "promote" itself.
The mandatory integrity label of an object (like a file or registry key) may be modified by a process with the SeRelabelPrivilege privilege. This privilege does not allow a process to unilaterally elevate its own process token integrity level; it is intended for managing the integrity requirements of securable resources.

Run as Administrator

The "run as administrator" functionality in Windows is implemented through User Account Control (UAC). When a user attempts to perform an action that requires administrative privileges, UAC triggers a consent prompt, which is also called an elevation prompt. This prompt notifies the user that a change is about to occur, and it asks for permission to proceed.

An alternative to the "run as administrator" option is sudo for Windows, which provides a way to elevate a command as an administrator from the command line.Sudo uses the UAC security feature for elevation, and it does not support running programs as other users.