What an application manifest declares
A small XML resource inside the binary states, before anything runs, whether the program will ever ask for elevation. It is one of the cheapest fields to read and one of the least read.
Most Windows executables carry an application manifest as a resource in
.rsrc, alongside the icons and the version block. It is XML, it is small,
and among other things it tells you whether the program intends to ask for
administrative rights.
That declaration is made at build time and cannot be changed without changing the file, which makes it a durable property rather than an observation about one execution.
The field that matters most
requestedExecutionLevel takes three values.
| Value | What the loader does | What it implies |
|---|---|---|
asInvoker |
Runs with the token of whatever launched it. No prompt, ever. | The program is designed never to touch the elevation boundary |
highestAvailable |
Elevates if the user is an administrator; runs as standard otherwise | Adapts to the account, so behaviour differs per user |
requireAdministrator |
Always triggers elevation | Cannot run at all without an admin decision |
Absent a manifest, older binaries fall back to installer detection heuristics,
which guess from the filename and a few strings. A file called setup.exe may
be treated as requiring elevation on the strength of its name, which is a
reminder that filenames still carry policy weight in places you would not
choose.
The other declarations worth reading
uiAccess="true" requests the ability to drive the UI of higher-privileged
windows. It is intended for accessibility software and carries real
requirements: the binary must be signed and must live in a protected
directory. It is rare, and worth noticing when it appears.
supportedOS lists GUIDs for the Windows versions the program was built to
declare compatibility with. It dates the build, roughly, in the same way a
countersignature dates it precisely, and it survives in files where nothing
else useful does.
longPathAware and dpiAware say nothing about privilege but say a
reasonable amount about how recently the program was maintained.
Why this is worth the read
asInvoker is the quiet one. A binary that declares it is stating that it
will never present an elevation prompt, which means every control that
operates at that boundary will observe nothing whatsoever about it. That is
not a gap in those controls: they are watching a line the software was
designed not to cross.
For anything that installs into a user profile, this field and the install location tend to agree with each other. When they do, you are not looking at an evasion. You are looking at software built for a distribution model where asking permission was never part of the design.
More of this
New posts on what a file tells you before you run it: headers, signatures, manifests, overlays, the fields most inventory never reads. Only when there is something worth the write-up.
We intend to offer a tool that does this across every file on an endpoint. You get one message when you can use it.