In server 2008 R2, if I run an app in administrator's mode, will child process still be in the same mode?

Yes, child processes inherit the access token of the parent process (from UAC Process and Interactions on TechNet):

Each application that requires the administrator access token must prompt the administrator for consent. The one exception is the relationship that exists between parent and child processes. Child processes inherit the user access token from the parent process. Both the parent and child processes, however, must have the same integrity level.


Somewhat related bonus info:

The runas utility has two poorly documented switch called /showtrustlevels and /trustlevel that seemingly allows you to launch (from an elevated process) a new process with a standard user token rather than your admin token, without lowering the integrity level of the child process:

runas /trustlevel:0x20000 cmd.exe

You'll find that the Window title contains (running as [username] with restricted privileges), and whoami will show a restricted privilege and group list, compared to the elevated prompt:

enter image description here


Yes, it will execute with Administrator privileges.

Simple test:

You can test this by opening the app as an Administrator and opening notepad.exe from the app. Try saving a blank text file to C:\Windows. If it does not throw a permissions error, then you know the child process (Notepad) is running with elevated privileges.


Yes, the child will be in admin mode.

This is why running cmd.exe as admin allows you to start other programs in admin mode.