How to detect UAC prompt appearance programmatically?

Question

Hello everyone,

This makes me stuck for a while. How do I detect UAC prompt appearing by Win32 C++ application on Windows 10(Home, Pro...19H2 and later)?

Answer 1

Hi,
Based on my search, Windows automatically elevates applications based on various criteria.
Before a 32 bit process is created, the following attributes are checked to determine whether it is an installer:
Filename includes keywords like "install," "setup," "update," etc.
Keywords in the following Versioning Resource fields: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name.
Keywords in the side-by-side manifest embedded in the executable.
Keywords in specific StringTable entries linked in the executable.
Key attributes in the RC data linked in the executable.
Targeted sequences of bytes within the executable.
So it seems related to application Manifest.
For this issue, I suggest that you may post it to MSDN dev forum.

The reason I we recommend posting appropriately is you will get the most qualified pool of respondents for Win32C++ issue.

Best Regards,
Carl

Answer 2

You can use SetWinEventHook with EVENT_SYSTEM_DESKTOPSWITCH (UAC, by default, uses the Secure Desktop)
and test if the process consent.exe is running
(tested on Windows 10, as Admin (Manifest with requireAdministrator) to detect consent.exe)