dotnet/runtime

Environment.IsPrivilegedProcess unexpectedly returns true on Windows

Open

#84,137 opened on Mar 30, 2023

View on GitHub
 (5 comments) (2 reactions) (0 assignees)C# (5,445 forks)batch import
area-System.Runtimedocumentationhelp wantedos-windows

Repository metrics

Stars
 (17,886 stars)
PR merge metrics
 (Avg merge 12d 11h) (661 merged PRs in 30d)

Description

Description

Environment.IsPrivilegedProcess return True if process is running with runas /trustlevel:0x20000 under local administrator account on Windows.

The main reason is that the local administrator account is excluded from UAC. It is unclear whether this is a bug in the GetTokenInformation. If not, then at the very least Environment.IsPrivilegedProcess behavior should be explicitly documented.

Also, I don't know if there is this problem for Service Accounts. In this case, the problem is more unpleasant and must be corrected.

Reproduction Steps

  1. Run process under local administrator account
  2. Run subprocess with runas /trustlevel:0x20000
  3. Call Environment.IsPrivilegedProcess in the subprocess

Expected behavior

Environment.IsPrivilegedProcess return FALSE

Actual behavior

Environment.IsPrivilegedProcess return TRUE

Regression?

No response

Known Workarounds

No response

Configuration

.Net 8.0 Preview 2

Other information

No response

Contributor guide

Research direction
Examine the Windows API GetTokenInformation usage in the .NET runtime's Environment.IsPrivilegedProcess implementation, specifically how it handles the local administrator account and UAC trust levels. Consider testing with different account types and documenting the expected behavior.
Tech stack
csharp
Domain
backendsecurity
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
C#Windows
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40