Is temp folder locked down for non UAC applications??

[Imrankhan]

I think windows locked the temp folder from being accessed by any program without admin rights.
When opening a file from an archive with Winrar, it just get extracted in the same folder before it is opened.

But goto WinRAR and File properties and then enable Run as Administrator in Compatibility settings. Everything works normal.

The file is extracted in Temp folder before getting opened.


And also, MSI installers are shows up error until they are run as administrators through CMD. We know msi installers gets extracted in temp folder and then installs.



This has been happening since last one week. So My question is this. Did Windows stopped programs from accessing temp folder without admin rights. Is it time to disable UAC. Will Diasbling UAC affect system security.

 

[andrew129260]

UAC does protect folders. Well kind of. It protects the C/windows program files directory.


The types of actions that require elevation to administrator status (and therefore display a UAC elevation prompt) include those that make changes to system-wide settings or to files in %SystemRoot% or %ProgramFiles%. Among the actions that require elevation:

• Installing and uninstalling applications
• Installing device drivers
• Installing ActiveX controls
• Installing Windows Updates
• Changing settings for Windows Firewall
• Changing UAC settings
• Configuring Windows Update
• Adding or removing user accounts
• Changing a user’s account type
• Configuring Parental Controls
• Running Task Scheduler
• Restoring backed-up system files
• Viewing or changing another user’s folders and files

UAC strips the administrator SID from a user's access token reducing him to a regular restricted ("normal") user. Applications can request elevation via manifests - then the entire process runs with the admin token.
If folders are not writeable with UAC enabled that means that NTFS security is set so that normal users cannot write but administrators can. As a remedy either change the permissions on those folders or run your application elevated (or redesign it so it writes to locations normal users have access to).
If you mean UAC virtualization (redirection of write attempts from system areas into the user profile): here is a good description of the feature from which I have copied the following:

• Virtualization is only enabled for:
  • 32 bit interactive processes
  • Administrator writeable file/folder and registry keys
• Virtualization is disabled for:
  • 64 bit processes
  • Non-interactive processes
  • Processes that impersonate
  • Kernel mode callers
  • Executables that have a requestedExecutionLevel

Sources:

http://stackoverflow.com/questions/6372383/get-list-of-folders-protected-by-uac

http://en.wikipedia.org/wiki/User_Account_Control


And my experience.

 

[Alejandro85]

The temp folder is user-specific and therefore, it always has full control from its owner, so no, there is no need to elevate to read or write to temp. Take a look on the permissions on it. It might be possible that they've been modified from their defaults, thus giving problems to non-elevated programs.