administrator credentials Archives

Winsage

March 18, 2026

Researchers Reveal ‘RegPwn,’ a Windows Registry Vulnerability That Granted SYSTEM Privileges

A Windows vulnerability named "RegPwn" (CVE-2026-24291) allows low-privileged users to elevate their access to full SYSTEM privileges. Discovered by the MDSec red team, it has been in use since January 2025 and was addressed in a recent Microsoft Patch Tuesday update. The vulnerability exploits the management of Windows accessibility features, which generate a registry key that grants full control to low-privileged users. When a user activates an accessibility tool, the configurations are copied into the local machine registry hive, which remains writable by the logged-in user. This creates an opportunity for manipulation, especially when user-controlled settings interact with the Windows Secure Desktop environment. An attacker can exploit this by modifying their user-level accessibility registry key and using an oplock on a system file, allowing them to replace the local machine registry key with a symbolic link to an arbitrary system registry key. This process operates under SYSTEM privileges, enabling the attacker to write arbitrary values to restricted areas of the Windows registry. MDSec demonstrated this technique to gain access to a SYSTEM-level command prompt. Microsoft has released security updates to address this vulnerability, and MDSec has made the exploit code available on GitHub for research purposes.

Winsage

February 17, 2026

Fix: UAC “Yes” Button Missing in Windows

The "User Account Control (UAC) Yes button missing" issue occurs when a user with a standard account attempts to authorize an action requiring administrator approval, resulting in the absence of the Yes button. To resolve this, the built-in Administrator account can be enabled by accessing Safe Mode and running the command PLACEHOLDER41726aa2dbf8cb10. After restarting, the user can log into the Administrator account, which has full privileges, and then grant administrator rights to their main account by using PLACEHOLDERd2270d55f540aab4 to change the group membership. After the main account is granted admin rights, the Yes button should appear in UAC prompts. It is recommended to disable the built-in Administrator account afterward for security by running net user administrator /active:no. If the device is managed by an organization, the user should contact their IT department for assistance. As a last resort for personal PCs, if no admin account is available, the user may need to reset or reinstall Windows after backing up important files.

Winsage

September 10, 2025

Windows 11 KB5065431 23H2 released, direct download links (.msu)

KB5065431 is the latest security update for Windows 11 23H2 devices, being rolled out as a reminder that this version will reach its end of life on November 11, 2025. Microsoft is migrating eligible 23H2 Home and Pro edition PCs to Windows 11 24H2, but the rollout was temporarily paused due to around a dozen reported errors, some linked to app compatibility issues. Most barriers to upgrading have now been resolved, allowing the automatic upgrade process to begin. The Enterprise and Education editions of Windows 11 23H2 have an extended support timeline until November 10, 2026. The KB5065431 update will automatically install on PCs, or users can manually install it using the offline update installer file (.msu). The Windows 11 22631.5909 build includes important fixes but no new functionalities, addressing issues like NDI streaming performance and enhancing security for SMB shares. It also introduces a UAC prompt for administrator credentials during certain operations, which can be disabled by administrators via group policy.

Winsage

September 5, 2025

Microsoft fesses up to Windows update that caused UAC prompts

Microsoft has acknowledged that the August 2025 security updates for Windows have caused unexpected User Account Control (UAC) prompts for users across all supported versions of Windows. The affected client versions include Windows 11 (24H2, 23H2, 22H2) and Windows 10 (22H2, 21H2, 1809, Enterprise LTSC 2019, Enterprise LTSC 2016, 1607, Enterprise 2015 LTSB). The server versions impacted are Windows Server 2025, 2022, 2019, 2016, 2012 R2, and 2012. The updates included a security enhancement (KB5063878) that enforced UAC prompts for administrator credentials during Windows Installer (MSI) repair operations to address the vulnerability CVE-2025-50173. Various scenarios can trigger UAC prompts for non-administrative users, including executing MSI repair commands, launching Autodesk applications, installing user-specific applications, and deploying packages via Configuration Manager. Standard users attempting to run applications that initiate MSI repair operations without a user interface may encounter errors, such as Error 1730 when trying to install Office Professional Plus 2010. Microsoft is working on a solution to allow IT administrators to permit specific applications to perform MSI repairs without triggering UAC prompts, which will be included in a future update. In the meantime, users are advised to run applications as administrators when possible, and IT admins can mitigate the issue by configuring a special Group Policy using Known Issue Rollback (KIR) for the affected Windows versions.

Winsage

September 5, 2025

Microsoft says recent Windows updates cause app install issues

Microsoft has acknowledged that the August 2025 security updates are causing unexpected User Account Control (UAC) prompts and installation challenges for non-administrative users across all supported Windows versions. This issue arises from a security patch addressing the CVE-2025-50173 vulnerability, which could allow authenticated attackers to escalate their privileges. New UAC prompts require administrative credentials in various scenarios, affecting standard users deploying packages via Configuration Manager and launching certain Autodesk applications. The affected platforms include Windows 11 (versions 24H2, 23H2, 22H2), Windows 10 (various versions), and several Windows Server versions. Microsoft stated that if a standard user runs an app triggering an MSI repair operation without a user interface, it will result in an error message, such as Error 1730 when installing Office Professional Plus 2010. Microsoft is working on a solution to allow specific applications to conduct MSI repairs without triggering UAC prompts and recommends running applications with administrative privileges as a temporary workaround. Additionally, Microsoft is addressing lag and stuttering issues with NDI streaming software on Windows 10 and 11, and clarified that there is no connection between the August 2025 update and reported SSD and HDD issues.

Winsage

September 5, 2025

Windows asks for admin rights where it shouldn’t after patch

Microsoft's August 2025 Windows Security Update aimed to fix a critical vulnerability (CVE-2025-50173) related to the Windows Installer, which allowed for privilege escalation. The update enforced User Account Control (UAC) prompts for administrator credentials during MSI repair operations, causing disruptions for standard users and leading to issues such as Error 1730 during the installation of Office Professional Plus 2010. This problem affects nearly all supported editions of Windows, including Windows Server 2012 and 2012 R2. Microsoft suggested running applications with administrative privileges as a workaround and recommended configuring the Known Issue Rollback (KIR) group policy, applicable only to specific Windows versions. Future updates are planned to allow certain applications to perform MSI repairs without UAC prompts.