Windows Administrator Protection

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://projectzero.google/2026/26/windows-administrator-protection.html
• Blog Title: Windows Administrator Protection
• Suggested Section: 🪟 Windows Hardening → Windows Local Privilege Escalation (or Windows Security Controls → UAC) — add a subsection on per-logon-session DOS device maps (\Sessions\0\DosDevices<LUID>) drive-letter hijacking via identification-level impersonation and lazy device-map creation

🎯 Content Summary

Project Zero analyzes Windows 11 25H2 “Administrator Protection” (a new elevation model intended to replace classic User Account Control) and details a silent bypass that results in full administrator code execution without an elevation prompt by abusing per-logon-session DOS device maps, identification-level impersonation semantics, and a race window when launching a shadow-admin process.

1) What Administrator Protection is trying to fix (why classic UAC was bypassable)
Clas...

🔧 Technical Details

Per-logon-session DOS device maps can override global drive letters: Windows resolves drive letters via ??, which typically maps first to \Sessions\0\DosDevices<LUID> (logon-session-specific) and only falls back to \GLOBAL??. If an attacker can create a C: symbolic link inside a target logon session’s DOS devices directory, they can hijack C: for processes in that session, redirecting file access and potentially DLL loading to attacker-controlled paths (leading to code execution in that process’s security context).

A subtle kernel behavior can make this writable even when the parent directory is non-writable: the DOS devices directory is created lazily by SeGetTokenDeviceMap using ZwCreateDirectoryObject without OBJ_FORCE_ACCESS_CHECK, so creation bypasses access checks. The parent \Sessions\0\DosDevices directory uses an inheritable CREATOR OWNER<...

🤖 Agent Actions

Updated UAC - User Account Control with a new section detailing the Windows 11 25H2 Administrator Protection bypass via per-logon-session DOS device map hijacking (drive-letter symlink). The section explains the lazy creation behavior, identification-level impersonation nuance, race window, exploitation steps using RAiProcessRunOnce and NtObjectManager, plus PoC snippet and note on KB5067036 fix. Added Project Zero blog to references.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://projectzero.google/2026/26/windows-administrator-protection.html

Content Categories: Based on the analysis, this content was categorized under "🪟 Windows Hardening → Windows Local Privilege Escalation (or Windows Security Controls → UAC) — add a subsection on per-logon-session DOS device maps (\Sessions\0\DosDevices<LUID>) drive-letter hijacking via identification-level impersonation and lazy device-map creation".

Repository Maintenance:

• MD Files Formatting: 944 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0