Mysterious String Entries

[Aegis]

If you open up advapi32.dll using a resource editor and view the string tables, there should be an entry like this:

STRINGTABLE
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
{
50001,  "Disallowed"
50002,  "Software will not run, regardless of the access rights of the user."
50003,  "Untrusted"
50004,  "Allows programs to execute with only access to resources granted to open well-known groups, blocking access Administrator and Power User privileges, and personally granted rights."
50005,  "Restricted"
50006,  "Software cannot access certain resources, such as cryptographic keys and credentials, regardless of the access rights of the user."
50007,  "Basic User"
50008,  "Allows programs to execute as a user that does not have Administrator or Power User access rights, but can still access resouces accessible by normal users."
50009,  "Unrestricted"
50010,  "Software access rights are determined by the access rights of the user."
}

Just curious what's it for and how to use it if anyone knows. Seems to me like it's some sort of user rights thing. If it is, then maybe Minlogon can support running programs with lower rights?

[Martin Zugec]

SAFER - martinzugec.blogdrive.com (AFAIR article no. 26) or today bink.nu post

[Aegis]

Will it work with Minlogon?

[Martin Zugec]

It should work... The link I talked about is http://martinzugec.blogdrive.com/archive/26.html (whoa, I am not as lazy as I though )

[Aegis]

I got DropMyRights to work, but is there any way to test that I actually have lower rights?

[Martin Zugec]

Yep... First way (I am using it) is using PrivBar, that will show you (in iexplore) what rights you are using.

Second (more universal way) is Security tab in Process Explorer from SysInternals.