Sunday, February 15, 2015

windows - GoogleUpdate.exe /ua switch, User account access?

I've noticed that after installing Google Chrome, two new Scheduled Tasks have appeared in my Windows 10 schtasks. One of them has the /tr of


C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

Now as far as I know, to create an schtask without the user password, you probably need to create it under the SYSTEM user, and apparently, with Google Update this is the case.


I have two questions:


1) In the arguments of GoogleUpdate.exe, can we assume that /ua is an abbreviation of "User Account"?


2) If so, how can a task running under SYSTEM account, actually manipulate a user account without for example, LoadLibrary or CreateRemoteThread or RtlCreateUserThread. Or is that what Google does?

No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...