Old Windows quirks help punch through new admin defenses
(2026/01/28)
- Reference: 1769606170
- News link: https://www.theregister.co.uk/2026/01/28/google_windows_admin_exploit/
- Source link:
Microsoft patched a bevy of bugs that allowed bypasses of Windows Administrator Protection before the feature was made available earlier this month.
James Forshaw, security researcher at Google's Project Zero, reported nine vulnerabilities in December that could allow attackers to silently grant themselves admin privileges on machines with the new Windows feature enabled.
Most of these related to previously known User Account Control (UAC) issues, Forshaw said, but, if exploited, could have subverted the whole point of [1]Windows Administrator Protection .
[2]
Microsoft has not yet opened up the feature for generally available builds – only Insider Canary users can tinker with it for now – but the idea behind it is to ensure that users only operate using the least privileges necessary.
[3]
[4]
A user can grant themselves admin privileges on the fly, but these are only granted in pre-approved circumstances and are revoked automatically as each process ends.
Forshaw said the most notable of the nine bugs he reported was a Logon Sessions flaw that relied upon five different [5]Windows behaviors. He added that he likely only found it because he was previously familiar with the OS's "weird behavior when creating the DOS device object directory."
[6]
The issue focuses on how Windows handles these directories for specific user sessions. Because the kernel creates a DOS device object directory on demand, rather than at login, it cannot check whether the user is an admin during the creation process.
Unlike UAC, Administrator Protection uses a hidden shadow admin account whose token handle can be returned by the system when calling the NtQueryInformationToken API function.
The researcher demonstrated that attackers can modify the token's owner security identifier to match their own user ID. Impersonating this token means that an attacker can force the kernel to create a new directory and assign ownership to them, effectively being able to control it.
[7]
Forshaw [8]wrote : "As access checking is disabled, the creation will still succeed; however, once it's created, the kernel will do an access check for the directory itself and will fail due to the identification token being impersonated."
[9]Microsoft Azure OpenAI Service takes an unscheduled day off in Sweden
[10]Office zero-day exploited in the wild forces Microsoft OOB patch
[11]Microsoft probes Windows 11 boot failures tied to January security updates
[12]Microsoft rushes out another fix for cloud storage after January update
Forshaw said he discovered this behavior in UAC some time ago, but never reported it as he could not find a scenario where a limited user could run code before any admin processes were created.
The introduction of Administrator Protection changed things because, unlike UAC, it creates a new unique logon session each time the user requests to elevate their privileges to admin level.
Further, due to a separate security mitigation Microsoft implemented to prevent C drive hijacking, the system service launching the process ignores the impersonated token's DOS device object directory. In this case, an attacker can exploit the bug, creating a DOS device object directory and redirecting the process's C drive, provided they can do it all before a process accesses a file.
Microsoft fixed this by preventing DOS device object directory creation when impersonating a shadow admin token at the identification level.
Forshaw said: "This issue is interesting, not just because it allowed me to bypass the protection but also because it was a potential UAC bypass that I had known about for many years, but only became practically exploitable because of the introduction of this feature." ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2025/01/18/windows_insider_administrator_protection/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aXpAuc83fUqKMiMkGKOwBAAAA8k&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXpAuc83fUqKMiMkGKOwBAAAA8k&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXpAuc83fUqKMiMkGKOwBAAAA8k&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2026/01/20/windows_11_pc_refresh/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXpAuc83fUqKMiMkGKOwBAAAA8k&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXpAuc83fUqKMiMkGKOwBAAAA8k&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://projectzero.google/2026/26/windows-administrator-protection.html
[9] https://www.theregister.com/2026/01/28/azure_openai_service_sweden/
[10] https://www.theregister.com/2026/01/27/office_zeroday_exploited_in_the/
[11] https://www.theregister.com/2026/01/26/microsoft_probes_windows_11_boot/
[12] https://www.theregister.com/2026/01/26/microsoft_outofband_patch/
[13] https://whitepapers.theregister.com/
James Forshaw, security researcher at Google's Project Zero, reported nine vulnerabilities in December that could allow attackers to silently grant themselves admin privileges on machines with the new Windows feature enabled.
Most of these related to previously known User Account Control (UAC) issues, Forshaw said, but, if exploited, could have subverted the whole point of [1]Windows Administrator Protection .
[2]
Microsoft has not yet opened up the feature for generally available builds – only Insider Canary users can tinker with it for now – but the idea behind it is to ensure that users only operate using the least privileges necessary.
[3]
[4]
A user can grant themselves admin privileges on the fly, but these are only granted in pre-approved circumstances and are revoked automatically as each process ends.
Forshaw said the most notable of the nine bugs he reported was a Logon Sessions flaw that relied upon five different [5]Windows behaviors. He added that he likely only found it because he was previously familiar with the OS's "weird behavior when creating the DOS device object directory."
[6]
The issue focuses on how Windows handles these directories for specific user sessions. Because the kernel creates a DOS device object directory on demand, rather than at login, it cannot check whether the user is an admin during the creation process.
Unlike UAC, Administrator Protection uses a hidden shadow admin account whose token handle can be returned by the system when calling the NtQueryInformationToken API function.
The researcher demonstrated that attackers can modify the token's owner security identifier to match their own user ID. Impersonating this token means that an attacker can force the kernel to create a new directory and assign ownership to them, effectively being able to control it.
[7]
Forshaw [8]wrote : "As access checking is disabled, the creation will still succeed; however, once it's created, the kernel will do an access check for the directory itself and will fail due to the identification token being impersonated."
[9]Microsoft Azure OpenAI Service takes an unscheduled day off in Sweden
[10]Office zero-day exploited in the wild forces Microsoft OOB patch
[11]Microsoft probes Windows 11 boot failures tied to January security updates
[12]Microsoft rushes out another fix for cloud storage after January update
Forshaw said he discovered this behavior in UAC some time ago, but never reported it as he could not find a scenario where a limited user could run code before any admin processes were created.
The introduction of Administrator Protection changed things because, unlike UAC, it creates a new unique logon session each time the user requests to elevate their privileges to admin level.
Further, due to a separate security mitigation Microsoft implemented to prevent C drive hijacking, the system service launching the process ignores the impersonated token's DOS device object directory. In this case, an attacker can exploit the bug, creating a DOS device object directory and redirecting the process's C drive, provided they can do it all before a process accesses a file.
Microsoft fixed this by preventing DOS device object directory creation when impersonating a shadow admin token at the identification level.
Forshaw said: "This issue is interesting, not just because it allowed me to bypass the protection but also because it was a potential UAC bypass that I had known about for many years, but only became practically exploitable because of the introduction of this feature." ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2025/01/18/windows_insider_administrator_protection/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aXpAuc83fUqKMiMkGKOwBAAAA8k&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXpAuc83fUqKMiMkGKOwBAAAA8k&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXpAuc83fUqKMiMkGKOwBAAAA8k&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2026/01/20/windows_11_pc_refresh/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXpAuc83fUqKMiMkGKOwBAAAA8k&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXpAuc83fUqKMiMkGKOwBAAAA8k&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://projectzero.google/2026/26/windows-administrator-protection.html
[9] https://www.theregister.com/2026/01/28/azure_openai_service_sweden/
[10] https://www.theregister.com/2026/01/27/office_zeroday_exploited_in_the/
[11] https://www.theregister.com/2026/01/26/microsoft_probes_windows_11_boot/
[12] https://www.theregister.com/2026/01/26/microsoft_outofband_patch/
[13] https://whitepapers.theregister.com/
Re: DOS? There's still DOS in windows?
seven of five
denial of service? There is loads of that in windows...
(yes, yes i know which dos you meant...)
Re: DOS? There's still DOS in windows?
Lazlo Woodbine
I think it's stuff like drive letters, which are still essentially DOS objects even when nothing else of DOS is left in Windows
Re: DOS? There's still DOS in windows?
Howard Long
Still is if you're on Windows 10 x86 32-bit, with the NTVDM DOS emulation feature enabled.
Re: DOS? There's still DOS in windows?
Philip Storry
There's no DOS code in Windows as far as I know.
But there are plenty of applications out there which still use old DOS virtual device files, so Windows has to present them or risk hundreds of thousands of apps breaking.
These virtual device files are things like COM1-COM9, LPT1-LPT9, CON, AUX, NUL.
That last one is probably the killer. These virtual device files exist in every folder in DOS, so a common way of testing a path exists was to look for
Killing the NUL virtual device file would probably break a huge amount of software.
The "DOS device object directory" referred to in the article is the system that creates and manages the mappings that allow this compatibility.
I hope that clarifies everything, feel free to ask if you have further questions.
DOS? There's still DOS in windows?
Or is this a different DOS? In which case, an extra word or 3 of explanation would be appreciated for some of the slightly more antique of us.