# Bypassing Administrator Protection by Abusing UI Access

UI Access processes in Windows Administrator Protection run at High integrity under the limited user, letting attackers silently compromise admin processes via window hooks.

- Payout: Research
- Severity: high
- Program: Windows Administrator Protection
- Credited: James Forshaw
- Disclosed: 2026-02-12
- Write-up quality: 9/10
- Original: https://projectzero.google/2026/02/windows-administrator-protection.html
- Library page: https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html
- Tags: domain:desktop impact:integrity impact:privesc kind:research platform:research sev:high tech:windows technique:chained technique:source-review vuln:auth-bypass vuln:privilege-escalation

**Target:** Windows UAC service (RAiLaunchAdminProcess) and UI Access process creation
**Root cause:** UI Access processes are created with the caller's limited-user token but elevated to High integrity, so they share the desktop and profile with admin processes; any code execution in such a process allows window-hook injection into High-integrity admin processes.
**Steps:**
1. Obtain code execution in a High-integrity UI Access process (e.g. MSIX install into C:\Program Files\WindowsApps, or TOCTOU via `Z:\osk.exe` with CREATE_SUSPENDED then remap Z:)
2. Enumerate admin-run scheduled tasks with `Get-AccessibleScheduledTask -Access Execute` filtering AllowDemandStart, Enabled, RunLevel Highest
3. Start `\Microsoft\Windows\DiskCleanup\SilentCleanup` which runs as shadow admin and creates a window
4. Call `SetWindowsHookEx` to inject a DLL into the cleanmgr.exe process
5. DLL executes as shadow administrator, bypassing Administrator Protection silently
**How found:** Reasoned about UIPI/UI Access design: noticed UI Access processes run under the limited user but at High integrity, breaking Administrator Protection's profile separation. Then hunted for code-execution primitives in UI Access processes by auditing secure directory checks (named streams, Tasks_Migrated, MSIX WindowsApps), reverse-engineering signed uiAccess executables, and inspecting RAiLaunchAdminProcess RPC parameters (DEBUG_PROCESS flag, lpApplicationName TOCTOU).
**Exploitation:** Attacker gets code execution in a High-integrity UI Access process (via MSIX install to WindowsApps, RAiLaunchAdminProcess DEBUG_PROCESS flag, TOCTOU on lpApplicationName, or DLL hijack via CommonProgramFiles/WebView2 registry override). Then triggers an admin scheduled task (SilentCleanup) that creates a window and uses SetWindowsHookEx to inject a DLL, gaining shadow administrator code execution without a consent prompt.
**Escalation:** Chains UI Access code execution with scheduled-task abuse and window hooks to reach shadow administrator; also token stealing via NtCreateLowBoxToken preserves UI Access flag to send messages to privileged windows.
**Insight:** When a privileged broker elevates integrity but keeps the caller's token, look for any code-execution primitive in that process (DLL search paths, RPC flags, installer-writable secure dirs) — then use window hooks against any admin process with a message-only window, not just visible UI.