SyncBack and Elevation

Author: Kostas Tsakiridis, 2BrightSparks Pte. Ltd.

Microsoft introduced a big change with Windows Vista regarding how administrators can exercise their administrative privileges. Before Windows Vista’s introduction, administrators would perform any task without the need to request additional authorization to do so. This meant that any application they ran would automatically inherit administrative privileges, which sometimes could prove fatal if the application was compromised (e.g. malware).

All this has changed with Windows Vista. Administrators, and any application they are executing, are limited to a standard user’s privileges until the administrators themselves authorize the application to run with administrative privileges. This action is called elevation and it is done via an alert pop-up dialog by the Windows operating system itself (called the User Account Control, UAC, prompt) which requests from the administrator to authorize the action. This ensures that applications that are most likely to make changes to the device, and that are entrusted by the users, are being allowed to run elevated.

Some of the actions requiring elevation are the following:

• Installing and uninstalling applications, device drivers and Windows Updates.
• Adding, removing user accounts, or changing a user’s account type.
• Changing system wide settings such as Windows Firewall.
• Viewing or altering system, program files folders/files or another user’s folders/files.

On the other hand, if a standard user wants to perform an administrative task, Windows will prompt the user for the credentials of an administrator account in order to carry on with the task. Failing to do so will stop the task from proceeding further.

How about SyncBack?

SyncBackPro and SyncBackSE require elevation when run by an administrator, meaning if the user is an administrator, then a UAC prompt will be displayed by Windows when run. Elevation allows SyncBackPro and SyncBackSE to perform tasks it otherwise could not, e.g. copy open/locked files with the use of Windows Volume Shadow-copy Service (VSS). Running SyncBack elevated has its drawbacks as well, for example SyncBackPro/SE cannot "see" mapped network drives defined by the user due to process isolation. To reduce the possibility of non-elevated applications communicating with elevated ones, the operating system will isolate these processes from each other.

Another feature of SyncBack which may get affected by elevation, or the lack of it, is profile scheduling which is discussed in detail in our Windows Task Scheduler article.

Starting from version V10.2.88.0, SyncBackPro and SyncBackSE can be launched without elevation by running the Non Elevated version of the application. Further, V11 introduced a new installer that allows standard Windows users to install SyncBack only for themselves, so they no longer need to be an Administrator to install SyncBack. When SyncBack is installed only for the current user then it will not run elevated.

And finally, as far SyncBackFree is concerned, it does not run elevated.

Some more technical details can be read in our Administrator Privileges and SyncBack KB Article.