Privilege Specification Model

UAC extends the access token system already in use for managing Windows logons with a new access token mechanism that supplies each administrator logon with two security access tokens: a UAC access token and a full administrator access token. The default access token is a standard user access token.

The default access token that is used to launch the desktop, the explorer.exe process, is a standard user access token, and any child processes of explorer.exe will inherit this standard user access token.