Additionally, this can also help protect against shatter attacks, which intercept Windows inter-process messages to run malicious code or spoof the user interface, by preventing unauthorized processes from sending messages to high privilege processes. Since the Secure Desktop allows only highest privilege System applications to run, no user mode application can present its dialog boxes on that desktop, so any prompt for elevation consent can be safely assumed to be genuine. If the application requesting elevation does not have focus before the switch to Secure Desktop occurs, then its taskbar icon blinks, and when focussed, the elevation UI is presented (however, it is not possible to prevent a malicious application from silently obtaining the focus). This is to prevent spoofing of the UI or the mouse by the application requesting elevation. UAC asks for credentials in a Secure Desktop mode, where the entire screen is faded out and temporarily disabled, to present only the elevation UI. If the user doesn't click Yes, after 30 seconds the prompt is denied. While standard users need to enter a username and password of an administrative account to get a process elevated ( Over-the-shoulder Credentials), an administrator can choose to be prompted just for consent or ask for credentials. If the user chooses to allow, the process initiating the action is elevated to a higher privilege context to continue. When some action is attempted that needs administrative privileges, such as installing new software or changing system or security settings, Windows will prompt the user whether to allow the action or not.

With this feature, all users, including users with administrative privileges, run in a standard user mode by default, since most applications do not require higher privileges. User Account Control is a new infrastructure that requires user consent before allowing any action that requires administrative privileges.

Windows terminal services screen blinks