What does mandatory integrity level value of 0x2010 stand for?

Question

I'm running the following snippet of code in my user-mode process that starts up when a Windows user account logs in to the workstation. Or, in other words, its path is placed in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key.

The code is supposed to determine the mandatory integrity level of my user process. It goes as such:

DWORD getMIL()
{
    //Try to get integrity level
    //-1                                            Unknown
    //SECURITY_MANDATORY_UNTRUSTED_RID              0x00000000 Untrusted.
    //SECURITY_MANDATORY_LOW_RID                    0x00001000 Low integrity.
    //SECURITY_MANDATORY_MEDIUM_RID                 0x00002000 Medium integrity.
    //SECURITY_MANDATORY_MEDIUM_PLUS_RID            SECURITY_MANDATORY_MEDIUM_RID + 0x100 Medium high integrity.
    //SECURITY_MANDATORY_HIGH_RID                   0X00003000 High integrity.
    //SECURITY_MANDATORY_SYSTEM_RID                 0x00004000 System integrity.
    //SECURITY_MANDATORY_PROTECTED_PROCESS_RID      0x00005000 Protected process.
    DWORD dwIntgtyLvl = -1;

    HANDLE hToken;
    if(OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &hToken))
    {

        DWORD dwSizeIntgtyLvl = 0;
        if(!GetTokenInformation(hToken, TokenIntegrityLevel, NULL, dwSizeIntgtyLvl, &dwSizeIntgtyLvl) &&
            ::GetLastError() == ERROR_INSUFFICIENT_BUFFER)
        {
            BYTE* pbIntgtyLvl = new BYTE[dwSizeIntgtyLvl];
            if(pbIntgtyLvl)
            {
                TOKEN_MANDATORY_LABEL* pTML = (TOKEN_MANDATORY_LABEL*)pbIntgtyLvl;
                DWORD dwSizeIntgtyLvl2;
                if(GetTokenInformation(hToken, TokenIntegrityLevel, pTML, dwSizeIntgtyLvl, &dwSizeIntgtyLvl2) &&
                    dwSizeIntgtyLvl2 <= dwSizeIntgtyLvl)
                {
                    dwIntgtyLvl = *GetSidSubAuthority(pTML->Label.Sid,
                        (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTML->Label.Sid)-1));
                }

                //Free mem
                delete[] pbIntgtyLvl;
                pbIntgtyLvl = NULL;
            }
        }

        ::CloseHandle(hToken);
    }

    return dwIntgtyLvl;
}

In a normal flow of events I'd expect to get the value of 0x2000 for SECURITY_MANDATORY_MEDIUM_RID, or 0x3000 for SECURITY_MANDATORY_HIGH_RID, but if I have one Windows user account already logged in, and if I then switch users, and log in with another user account, the method above will get me the value of 0x2010 for the mandatory integrity level.

Does anyone know what that value stands for?

Answer 1

It's described right at the bottom of the MSDN page on Windows Integrity Mechanism Design:

The RIDs are separated by intervals of 0x1000 to allow for definition of additional levels in the future. The separation also allows assigning an integrity level to a process that is slightly higher than medium: for example, to meet specific system design goals.

...

Applications that are launched with UIAccess rights for a standard user are assigned a slightly higher integrity level value in the access token. The access token integrity level for the UIAccess application for a standard user is the value of medium integrity level, plus an increment of 0x10. The higher integrity level for UIAccess applications prevents other processes on the same desktop at the medium integrity level from opening the UIAccess process object