Why Upgrade?

If I Remove Internet Explorer, Will My IE System Components Update?

Deployment

• When choosing a method, keep in mind prerequisites, number of reboots, language packs, and cumulative updates.
• If you are planning to leverage Enterprise Mode or Site Discovery functionality, you will need cumulative updates applied (June ‘15 or greater). Otherwise, this functionality will not work until the updates are applied.

• Internet Explorer 11 Deployment Guide
• Choose how to install Internet Explorer 11
• How to create an all-inclusive deployment package for Internet Explorer 11

 Configuration

• Leverage the ADM template for Internet Explorer (inetres.admx).  This contains the recommended default policies that apply to IE.
• Group policy preferences for IE are available as an Internet Settings Extension in the User Configuration section.
• If you used Internet Explorer Maintenance (IEM) in the past, GPP is its replacement. Use this reference to map IEM settings to GPP.
• When you test sites for compatibility, configuration can influence compatibility. Test in an environment that matches your planned production configuration.

Compatibility

1. View the Enterprise Mode Deep Dive from Ignite.
2. Download the Web Application Compatibility Lab Kit. This contains an excellent overview presentation and documentation to understand, configure, and use Internet Explorer’s compatibility features.

Inventory

What Compatibility Mitigation should I Use?

Modernizing Web Sites

• IE compatibility changes by version
• Modernization tools

 Summary

• Pick a deployment technique that will deploy IE with the latest cumulative updates.
• Leverage the ADM templates and decide on your configuration settings early. Test using your planned production settings.
• Leverage Enterprise Mode site list to mitigate older sites.
• Keep in mind that compatibility features can be layered. Add only broken sites to the Enterprise mode site list.

What are the Defaults?

How do I Change the Default WebBrowser Document Mode?

Compatibility Meta Tag

FEATURE_BROWSER_EMULATION Registry Key

32-bit and 64-bit Complexities

What’s the Difference Between a Setting that Ignores the !DOCTYPE and the One that Doesn’t?

What Happens if I Set the FEATURE_BROWSER_EMULATION Document Mode Value Higher than the IE Version on the Client?

Does the Compatibility View List or Enterprise Mode Affect the Behavior of the WebBrowser Control?

Debugging Your WebBrowser Control App in Visual Studio

Using IE to Determine what Document Mode You Need

What is Sideloading?

Windows 8 Store Apps are deployed through the Windows Store.  This may seem like an obvious statement. However, by default, only Windows Store apps are permitted to install and run on Windows 8. When you install an app from the Windows Store, a Windows Store signed app package is downloaded and installed on your machine. Since only Windows Store signed apps are permitted to be executed on Windows 8, it greatly reduces the introduction of malware. For development and enterprise scenarios, you can use a technique called sideloading to install and run apps that are not Windows Store signed. I’ll cover development sideloading in this post. If you are interested in how to use sideloading for line of business apps in an enterprise, please see this post.

Development Sideloading

Development sideloading is used by Visual Studio to deploy, debug and test your app.

The general requirements for sideloading are:

1. Your appx package needs to be signed.
2. The certificate used for signing needs to be trusted.
3. A policy (or registry key) needs to be set to allow trusted apps to run.

On a development machine, these requirements are automatically met for you by Visual Studio. Visual Studio provides a self-signing test certificate that is used to sign the package. Also, when Visual Studio is installed, a registry key is set to allow trusted apps to run. Therefore, when you debug a Windows 8 Store app using Visual Studio, the app is test certificate signed, deployed, and allowed to run.

How do I Sideload My App on Another PC or ARM Device?

In order to deploy an app, you need an App Package. Visual Studio has functionality to create an App Package you can use to deploy your app to another machine. The following steps are how to create a local App Package.

1. In Visual Studio Express 2012, choose “Create App Package” in the Store menu.
    
   Note: In Visual Studio 2012 Ultimate, the Store menu is in a different location. In the “Project” menu, use the “Store” option .
2. In the Create App Package wizard, you will want to create a local package. Therefore, answer “No” to the “Do you want to build a package to upload to the Windows Store”. Notice the information text indicates this is the option for sideloading.
   
3. The next dialog provides a choice of processor platforms to target. In most cases, you would want to choose “Any CPU”. This will allow you to target all of the processor platforms and architectures. However, if you are using platform specific binaries in your app, you’ll need to build separate packages for each platform.
   
4. In my example, I’ll just leave the default “Any CPU” and click “Create”
   
   Note the wizard gives us a link to where the package was created.

If we click the link, here is an example of what was created:

Here is a quick summary of the relevant files in the package directory:

Appx package (MyApp_1.0.0.0_AnyCPU_Debug.appx)

The appx package is a zip file of all of the program files for your app. This file gets deployed and installed into Windows. Try renaming the extension to “.zip” and open the zip file to see what is inside. Don’t forget to change it back before you try and deploy it.

Developer test certificate (MyApp_1.0.0.0_AnyCPU_Debug.cer)

This is your development certificate. This is the certificate that was used to sign the appx package.

PowerShell script (Add-AppDevPackage.ps1)

This PowerShell script can be used to install the development certificate and install the App.

Installing the App on the Target Machine

Everything you need to deploy the app is included in the package directory created by Visual Studio. I usually copy the directory to a USB memory stick to transfer the app to the target machine. On the target machine, you just need to run the PowerShell script (Add-AppDevPackage.ps1) to deploy the app. You can do this easily by right clicking on the script and selecting “Run with PowerShell”.

The first action performed by the script is to install the certificate. It needs to run elevated in order to perform this step. If PowerShell isn’t running elevated, the script will prompt to start an elevated process to install the certificate.

You will be warned and prompted to allow the certificate to be installed.

Once the certificate is installed, the app package is installed.

 Your app should now be installed on the target machine. You should be able to find the tile on the Start screen (usually at the end of the list):

The final requirement is to allow trusted apps to run. If your target machine has Visual Studio installed, this requirement will already be met. However, if you don’t have Visual Studio installed, you can meet the requirement through group policy or setting a registry key.  For development purposes, it’s usually easiest to set the registry key.

• Use RegEdit to navigate to the key: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx
• Set AllowAllTrustedApps (REG_DWORD) to the value of 1

Your app should now run on the target machine.

One final note… This is the process for development sideloading. There is a more formal process for enterprise sideloading.  If you are interested in enterprise sideloading, please start with this post.

How Much “Touch” is Enough?

One benefit of Windows touch is single touch and multitouch gestures are converted to mouse messages if they aren’t handled explicitly by your application. Therefore, your application may be somewhat touch friendly already. Depending on the touch scenario you want to support, you may only need to tweak your application in a few areas and be able to provide a good touch user experience. A good reference to explain what makes an application touch “friendly”, “enabled” or “optimized” is the MSDN Touch Guidelines.

For the remainder of this post, I’ll focus on key touch considerations and suggest ways to implement using native C++.

Touch Input Panel (TIP)

The TIP can be very handy if you want to allow users to enter text without a keyboard. Several “slate” PC’s now exist and either have an external keyboard or allow the user to configure the notebook to hide the keyboard. The TIP has existed since Tablet PC edition and is available in all versions of Windows 7. For native code, the TIP is displayed when the system caret is displayed.

Here is sample code that displays the system caret in a window if you click the left mouse button.

CreateCaret(hWnd, NULL, 5, 20);
xPos = LOWORD(lParam); 
yPos = HIWORD(lParam);

SetCaretPos(xPos,yPos);
ShowCaret(hWnd);

This is the behavior in an application:

Since the TIP is displayed when the caret is displayed, most native controls that allow text entry will display the TIP.  If you are planning on using DirectX, the TIP will not display in full screen mode. You will need to implement your own text entry for full-screen mode DirectX applications.

Screen Orientation and Rotation

The Windows 7 Engineering Guidance for Slate PCs recommends PC’s to enable screen rotation automatically through sensors or a manual hardware button. If you plan on targeting mobile touch PC’s, you should consider supporting screen rotation for your touch application. To support rotation, you generally detect the screen dimensions have changed and then change the layout. If your application supports window resizing, you can leverage that same functionality for screen orientation and rotation.

For native C++ applications, you can determine landscape or portrait orientation by using the GetSystemMetrics function to retrieve the height and width of the full screen. For screen rotation, you can listen for the WM_DISPLAYCHANGE message in your  WindowProc function's switch statement.  For code samples on detecting screen orientation and rotation, see Detecting Screen Orientation and Screen Rotation in Tablet PC Applications.

Gestures, Manipulations, and Inertia

Developing in native C++ allows you full access to all of the Windows 7 touch API’s. Therefore, you can implement simple gestures or very complex custom manipulations.  Here’s a quick summary of each item.

• For raw touch information, you  can register your application to receive WM_TOUCH messages. WM_TOUCH messages combine down, up, move and other states into one message.
• If you plan on just implementing well know gestures such as pinch zoom, rotate, pan, etc., you can use the WM_GESTURE message which is generated for common gestures.
• For manipulations, the application needs to implement the IManipulationProcessor interface.
• For inertia, the IInertiaProcessor interface can be used in conjunction with the IManipulationProcessor interface.

One of the best resources for native touch development the Touch topic in the Windows Platform SDK.  Also be sure to review the SDK samples on touch as well.

How Much “Touch” is Enough?

One benefit of Windows touch is single touch and multitouch gestures are converted to mouse messages if they aren’t handled explicitly by your application. Therefore, your application may be somewhat touch friendly already.  Depending on the touch scenario you want to support, you may only need to tweak your application in a few areas and be able to provide a good touch user experience. A good reference to explain what makes an application touch “friendly”, “enabled” or “optimized” is the MSDN Touch Guidelines.

For the remainder of this post, I’ll focus on key touch considerations and suggest ways to implement using WPF.

Text Input Panel (TIP)

The TIP can be very handy if you want to allow users to enter text without a keyboard. Several “slate” PC’s now exist and either have an external keyboard or allow the user to configure the notebook to hide the keyboard. The TIP has existed since Tablet PC edition and is available in all versions of Windows 7. WPF will display the TIP automatically for most controls such as the TextBox control. If you touch the TextBox, you will see a TIP icon.

If you touch the TIP icon, the virtual keyboard is displayed

Almost all of WPF’s controls that accept text entry support TIP. However, PasswordBox does not support TIP. You will want to avoid using PasswordBox or implement your own way to input passwords without a keyboard.

Screen Rotation

The Windows 7 Engineering Guidance for Slate PCs recommends PC’s to enable screen rotation automatically through sensors or a manual hardware button. If you plan on targeting mobile touch PC’s, you should consider supporting screen rotation for your touch application. To support rotation, you generally detect the screen dimensions have changed and then change the layout.

One way to detect a screen rotation is to register for the DisplaySettingsChanged event.  The following is some sample code that registers for the DisplaySettingsChanged event. The DisplaySettingsChanged handler changes the Window title and size of a WrapPanel to change the control layout.

public MainWindow()
{
    Microsoft.Win32.SystemEvents.DisplaySettingsChanged +=new System.EventHandler(displaySettingsChanged);
}

private void displaySettingsChanged(object sender, EventArgs e)
{
    if (System.Windows.SystemParameters.PrimaryScreenHeight > System.Windows.SystemParameters.PrimaryScreenWidth)
    {
        //Run the application in portrait

        this.Title = "Portrait View";
        wrapPanel1.Width = 600;
        wrapPanel1.Height = 800;
    }
    else
    {
        //Run the application in landscape

        this.Title = "Landscape View";
        wrapPanel1.Width = 800;
        wrapPanel1.Height = 600;
    }
}

Landscape view:

Portrait view:

For more information on detecting screen rotation, see Detecting Screen Orientation and Screen Rotation in Tablet PC Applications. 

Gestures, Manipulations, and Inertia

WPF is one of the easiest Windows development platforms that enable touch manipulation of objects.  The UIElement, UIElement3D, and ContentElement classes expose events that occur when a user touches an element. Several other controls support touch-enabled scrolling. The UIElement supports manipulation which is interpreted to scale, rotate, or translate. I won’t go into the details of implementing manipulations within this post because there is great information on this already. To get started, please review Walkthrough: Creating Your First Touch Application on TechNet.

Why is this happening (when I boot; every 5 minutes; intermittently)?

Identifying the Service

More Clues

Even More Clues…

The Tile Button is Displayed Too Quickly and I Can't Click it Fast Enough

Can I Disable the Notification?

Most applications do a poor job of reporting unexpected errors. A lot of times, the developer didn’t plan for the error and it gets bubbled up as a misleading error or a crash to the user. Compatibility issues tend to fall in the unexpected category.  I’ve categorized the usual causes of these expected issues and the troubleshooting tools I use.

UAC: Permission Issues

Application compatibility permission issues are usually a result of applications not being designed for standard user. The application assumes that the user has full administrator privileges and has issues running with User Account Control (UAC) enabled.

Process Monitor is the first tool you should use in identifying a possible permission issue. Process Monitor logs all file and registry activity (among other things). This can be very handy when looking for a permission issue. 

Start Process Monitor prior to the issue occurring.  Make sure you are capturing at least the file and registry activity.

Since this tool logs everything that is happing on the system, make sure to take advantage of the filtering feature.  You may want to filter on PID or Process Name.  For example, I’m only including the process name “legacyUAC.exe”.

Tips:

• You probably have a good idea about what file or registry is giving you a problem.  You can use the “find” function to find the file or key.
• Permission issues tend to return a status of “ACCESS DENIED”.  Try adding a filter for “Result is ACCESS DENIED”:
• UAC virtualization will be indicated by a result of “REPARSE” followed buy a log entry to the virtual store location.  See this post for details on UAC virtualization.
• Sometimes highlighting can be more useful than filtering. For example, you may want to see the log entries that occur around the same time as another log entry.  REPARSE is a good example.  Highlighting works like filtering.  You can get to the highlighting dialog from the menu. A shortcut to add highlighting (and filtering) is to right click on the column/row and add the highlight condition.
   

UAC: Integrity Level Issues

If you have applications that communicate to other processes especially via Windows messages, you may run into Mandatory Integrity Level (MIC) issues.

Process Explorer is a great tool for a lot of troubleshooting tasks. If you need to see at what integrity level a process is executing, Process Explorer has a column that reports the integrity level of running processes. Simply check “Integrity Level” under View | Select Columns… in the menu. Here’s an example screenshot:

Version Checking Issues

Version Checking issues are a very common compatibility issue. Applications will check the OS version and make decisions on whether to run or exit, use certain APIs, perform functionality, etc. Depending on how the version check logic is written, the code may make an incorrect choice on a new OS Version.

Application Verifier is one of the best tools to “lie” about the OS version to an application. Application Verifier intercepts Windows version API’s and returns any version number you want to specify.  So, if I’m having an issue, I can set the version number to a previous OS to verify I have a version checking issue.

Just add your application to the application list Application Verifier will monitor and test.  Check the HighVersionLie test only for version checking. Application Verifier has a lot of test that focus on reliability.  You may get unexpected crashes if you do some of the default memory tests.

By default, the HighVersionLie test increments the major and minor OS version numbers by 2.  Windows 7 is version 6.1. Therefore, you application will think it’s running on OS version 8.3. Here’s sample output from my legacyVersion sample app:

>legacyVersion.exe
OS Version using GetVersion (Major.Minor.Build): 8.3.8600
OS Version using GetVersionEx (Major.Minor.Build): 8.3.8600

MajorVersion==5 is FALSE. I'm NOT Win2000 or XP
MajorVersion==5 && MinorVersion==1 is FALSE. I'm NOT XP
MajorVersion==6 is FALSE. I'm NOT Vista
MajorVersion==6 && MinorVersion==0 is FALSE. I'm NOT Vista
MajorVersion>=5 && MinorVersion>=1. I'm XP or greater

*** Most correct version check ***
MajorVersion>=6 && MinorVersion>=0. I'm Vista or greater

If you want to test some other version number, right click the HighVersionLie test and select properties.  Enter the version you want to test:

Note: Application Verifier always attaches to the applications in its list regardless if the UI is active. Remember to delete the application from the list when you are done troubleshooting.

The nice thing about Application Verifier is that you can set the version number to anything. This can be useful in determining if your app has any version checking issues on a future OS. By default, the HighVersionLie test increments both the major and minor version numbers by 2.

Checking Manifests

Sigcheck is a signature checking tool. However, the –m switch allows you to dump the manifest. This is a quick way to see an application manifest for an executable.

The application manifest is a resource in the executable. You can also use a resource editor to view the manifest. With a resource editor, you could also modify the manifest which could help in debugging the issue.  For more information on manifests, see my manifest post.

Performance

If you are trying to uncover a performance issue, Process Explorer can help you narrow down the issue quickly.  I run Process Explorer with the system tray icons.  This allows you to monitor thumbnail performance graphs for the system.  If you notice a high value or spike, you can hover over the icon and get a possible clue of what might be causing the issue.  In this screenshot, you can see I hovered over the CPU icon and we see the suspicious application CPUHog.exe consuming 49% of the total CPU.

To turn on the tray icons, select the icons you would like to see from the Options menu.

Another handy performance option in Process Explorer is to use the  CPU History columns  This will show the CPU history graph for all processes.  This can be useful if you have intermittent CPU spikes. Just add the CPU History column in the View | Select Columns menu.

If you need advanced performance analysis, you can use XPerf in the Windows Performance Toolkit (WPT). XPerf allows you to capture and view Windows event data for everything that is going on in the operating system. This is a very powerful tool that you can obtain very detailed information. It may take some practice before you get proficient with this tool.

Boot Performance

If you are encountering slow boot times, you may need to analyze what is in the boot path to pinpoint the problem. Process Monitor provides a quick and easy way to log boot time activity.

Select Options | Enable Boot Logging

This will log the file, registry, profiling information during your next boot.  You can then review the log to identify possible applications that are consuming a lot of resources during the boot cycle.

If you are interested in in depth boot performance analysis, you can use the Windows Performance Toolkit (WPT).  See the Windows On/Off Transition Performance Analysis whitepaper for details on how to use WPT to analyze boot performance.

Crashes

For crashes, you will need to use a debugger. I generally use WinDbg.

If you can reproduce the crash, don’t dismiss the crash dialog.  By leaving the dialog, the process still exists and you can attach to the process with the debugger and diagnose the exception. 

Press F6 and attach to the process.

Ideally, you can load your symbols at this point.  If you have debug symbols for the application, the debugger can give you more information about the exception. Once you have your symbols loaded, try a !analyze –v command.  The debugger will try to give you some analysis of the exception.

In this case, it looks like we have an invalid argument.

Saving dumps

Sometimes, you may want to save dumps for analysis later.  Maybe it’s on a non-development machine or you want to collect several dumps. You can configure Windows 7 and Windows Server 2008 R2 to always generate and save a dump file.

• Create a key named: HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps
• Dumps will default to the following directory: %LOCALAPPDATA%\CrashDumps
• You can override the default with a DumpFolder value (REG_EXPAND_SZ)
• You can also limit the number of dumps saved with a DumpCount value (DWORD)

For more info see: http://blogs.technet.com/b/askperf/archive/2008/02/05/ws2008-windows-error-reporting.aspx

What about Hangs?

For hangs, the first tool I uses is Process Explorer. If an application is slow and unresponsive, I start Process Explorer and use crosshair on the toolbar and drag and drop on to the unresponsive window.  This will highlight the process in the list. I then double click the process in the list and then look at the Threads tab. You can then double click the threads to look at the stack.  This usually points you in the right direction. Here we can see that in CPUHog.exe, the tightLoop routine is probably a good place to start looking for an issue:

Error codes

Sometimes it’s easy to forget that there’s a tool to look up error codes. Err.exe in the SDK. This utility can be used to look up what the description for a particular code. Err.exe uses error codes defined in header files. It exists in the Bin directory of the SDK. e.g. C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin.

For example, let’s look up error code 5.

C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin>err 5
# for hex 0x5 / decimal 5
  BTH_ERROR_AUTHENTICATION_FAILURE                               bthdef.h
  INVALID_PROCESS_ATTACH_ATTEMPT                                 bugcodes.h
  CDERR_LOADSTRFAILURE                                           cderr.h
  CR_INVALID_DEVNODE                                             cfgmgr32.h
  DHCP_DROP_UNAUTH                                               dhcpssdk.h
  LLC_STATUS_PARAMETER_MISSING                                   dlcapi.h
  HIDP_GETCOLDESC_PREPARSE_RESOURCES                             hidpddi.h
  IAAPI_TOOBIG                                                   iaapi.h
# /* Value exceeds size constraint */
  MD_ERROR_SUB400_INVALID_TRANSLATE                              iiscnfg.h
  MD_ERROR_SUB401_APPLICATION                                    iiscnfg.h
  MD_ERROR_SUB403_SSL128_REQUIRED                                iiscnfg.h
  MD_ERROR_SUB404_URL_SEQUENCE_DENIED                            iiscnfg.h
  MD_ERROR_SUB503_CONNECTION_LIMIT                               iiscnfg.h
  IME_RS_TOOLONG                                                 ime.h
# given string is too long
  KDC_ERR_S_OLD_MAST_KVNO                                        kerberr.h
# 5 Server's key encrypted in old master key
  RSVP_Err_BAD_STYLE                                             lpmapi.h
# /* Conflicting style        */
  POLICY_ERRV_IDENTITY_CHANGED                                   lpmapi.h
  POLICY_ERRV_SUBNET_DEF_FLOW_COUNT                              lpmapi.h
  MAPI_DIAG_MAXIMUM_TIME_EXPIRED                                 mapidefs.h
  SE_CATEGID_DETAILED_TRACKING                                   msaudite.h
# Detailed Tracking
  MSIDBERROR_UNDERFLOW                                           msiquery.h
# data less than minimum value allowed
  NRC_CMDTMO                                                     nb30.h
# /* command timed out                          */
  NDDE_INVALID_SHARE                                             nddeapi.h
  NMERR_NO_MORE_FRAMES                                           netmon.h
  SMART_INVALID_DRIVE                                            ntdddisk.h
# Drive number not valid
  DS_NAME_ERROR_DOMAIN_ONLY                                      ntdsapi.h
  SAM_PWD_CHANGE_NOT_COMPLEX                                     ntsam.h
  ODBC_ERROR_INVALID_REQUEST_TYPE                                odbcinst.h
  OLE_ERROR_STREAM,                                              ole.h
# (OLESTREAM) stream error                 */
  MFE_OIF_PRUNED                                                 routprot.h
# no downstream receivers exist on oif
  SCESTATUS_BUFFER_TOO_SMALL                                     scesvc.h
  SE_ERR_ACCESSDENIED                                            shellapi.h
# access denied
  SNMP_ERRORSTATUS_GENERR                                        snmp.h
  SNMP_GENERICTRAP_EGPNEIGHLOSS                                  snmp.h
  TWCC_OPERATIONERROR                                            twain.h
# /* DS or DSM reported error, app shouldn't   */
  CMC_STATUS_CONFIRM_REQUIRED                                    wincrypt.h
  CMC_FAIL_UNSUPORTED_EXT                                        wincrypt.h
  ERROR_ACCESS_DENIED                                            winerror.h
# Access is denied.
  LDAP_COMPARE_FALSE                                             winldap.h
  SNMP_ERROR_GENERR                                              winsnmp.h
# as an HRESULT: Severity: SUCCESS (0), FACILITY_NULL (0x0), Code 0x5
# for hex 0x5 / decimal 5
  ERROR_ACCESS_DENIED                                            winerror.h
# Access is denied.

We can see there are lots of definitions for the error code of 5. Depending on what header files you include in your code, you can figure out what the actual error is.  If you don’t have access to the code, you can usually make an educated guess on which error you are encountering.

I hit on most of the tools I use to solve most of the issues I’ve seen.  I really hope this helps you find issues and be able to solve them.

Pat

The magic happens when explorer.exe is started using the filtered token.  Explorer.exe is your taskbar and is responsible for starting everything on the desktop. By default, child processes are started with the same token as their parent. Therefore, since explorer.exe is started with the filtered token, everything that is launched by the taskbar is standard user by default (presto!).

Bonus question: What token is used to start explorer.exe with UAC disabled? Answer: The full administrator token.  This is why Windows 7 (and Vista) behave like traditional NT with UAC disabled.

What if you want to use the full token?  You can run you application elevated (right click and select “Run as Administrator”). This will start the application with the full token instead of the filtered token. As an application developer, if you have a good reason to always start an application with the full token, you would set the appropriate run level in the manifest.

Let’s take a look at two different command prompts to illustrate this concept.

The following is a command prompt started from the taskbar:

The following is a elevated command prompt started from the taskbar via right clicking and choosing “Run as Administrator”:

We can see that the user name and the SID are identical.  However, the non-elevated command prompt only has the privileges of a standard user.

What’s a Standard User?

Finding UAC Issues

• Write to Program Files, Windows, System32, HKLM/Software, or Root?
• Create anything “globally” like a memory mapped file?
• Send Windows messages between an app running as standard user to one running elevated? (See: this post)

Next Steps