Environment Variable Filter

Owned by Anonymous
Last updated: Mar 24, 2015 by Max Pinion (Deactivated)
1 min read

An Environment Variable Filter compares an environment variable of a process to a specified value. Use the Environment Variable filter for compatibility testing and user-requested elevation. Most users will use only the two built-in Environment Variable filters.

Manual Application Compatibility Setting 

The Manual Application Compatibility Setting filter targets any application that is forced to run in compatibility mode. 

For example, if you right-click an application on your computer, then click Properties > Compatibility, and then select Run this program in compatibility mode for: Windows XP, then whenever you launch that application the environmental variable "__COMBAT_LAYER" will be added to the application. You would use this filter to detect any applications that are being run in compatibility mode.

UAC Detected

Detects whether an application has been run with a user-initiated elevation request.

User Requested Run as Administrator

The User Requested Run as Administrator filter determines whether users request to run an application as an administrator by right-clicking an application and then clicking  Request Run As Administrator. 

This filter is commonly used in the built in "User Requested Elevation Justification" policy to show a justification message and elevate an application. You can clone this Application Control policy and create several different policies for specific user groups, making it possible for higher-level users to justify and elevate, and for normal users to send a justification but not elevate. (For detailed instructions on cloning a policy, go to Policies.)

 

Existence Test

When creating a new Environment Filter, if you do not specify a Value and you set the Match Type to Partial, then the filter is an existence test.

Self-Elevation

UAC Override