Bypassing Administrator Protection by Abusing UI Access

This blog post analyzes nine bypasses (focusing on five root causes) in Windows UAC/Administrator Protection tied to the UI Access implementation. It documents multiple exploitation vectors—bypassing secure application directory checks, DLL planting/repurposing signed UI Access executables, RAiLaunchAdminProcess parameter and TOCTOU weaknesses, shared-profile/environment hijacks (e.g., WebView2/Quick Assist), scheduled-task/window-hook escalation, and token-stealing techniques—provides PoC approaches and PowerShell tooling, and notes that the reported issues were fixed while cautioning that code execution in a High-integrity UI Access process still enables silent elevation bypasses.