ViperAFK, on 25 May 2012 - 03:16, said:
He's sort of right, in that services do not need UAC prompt, but a program has to install the service in the first place which does require a prompt. Programs like steam for example will use a background service, so installing games doesn't require UAC prompt.
Sorry, I phrased that poorly. I was only referring to background processes that execute through an interactive desktop user, not non-interactive system services.
Actually the Steam service only facilitates registry changes without UAC elevation on behalf of a game prior to its first launch, and maybe change some registry ACLS here and there if a game keeps preferences in the system hive (very rare with modern games). It also helps Steam update without UAC elevation. It does nothing else.
Now, far as the file system goes, installing games on Steam does not call on UAC because the Steam client installer alters the ACLS on the Steam directory (defaults to "%ProgramFiles%\Steam" or "%ProgramFiles% (x86)\Steam" based on your Windows architecture). This directory is set so the "Users" group always gets "Full Control" over everything inside. If you strip this ACL away, the Steam client can no longer function for limited users, but if Steam launches as an Administrator it will automatically add the ACL back and then limited users can use it again. (And this is why I slap the Steam directory with harsh AppLocker whitelist only rules; any user and any processes running as a user can insert code into the Steam directory)
At no time does Steam automatically bypass UAC for...
...launching a game.
...third party copy protection activation or deactivation.
...installation of third party redistributions such as PhysX, DirectX, OpenAL, etc.
All of those trigger UAC elevation.
Fun fact: If your logged in as a limited user and Steam calls on UAC elevation during first launch of a game, when you enter your admin credentials everything related to redists as well as the game itself will execute as your admin user. This normally only happens the first time ever you launch that game on that install of Windows. As a side effect, if the game places its save files in the user profile, all saves during that first launch go to the admin directory that UAC authenticated and not your limited user. If you played a lot during that first session, you then have to go find your saved games in that admin profile and transfer it to your limited profile.
UAC becomes much more beneficial if you are using it in conjunction AppLocker policies in Windows 7 or 8, and in Vista if you use the more limited Software Restriction Policies that AppLocker replaces. (Note that home edition of 7 doesn't get AppLocker, and only 8 Enterprise will get AppLocker which is why I've already moved back to using Windows Server as my desktop environment for 2012 Release Preview.)
0
