Somehow able to write to ProgramData with UAC enabled in Windows 8

Question

Based on the assumption that standard users can't write directly to ProgramData on Vista and later, I'm creating a directory inside it and giving all users full control of that for my program's use. It works fine, but during testing I tried to run some test code as Guest (which is supposed to be restricted) and it successfully created the directory and granted the intended rights. I wasn't expecting that to work, when I've seen so many stories of that kind of thing not working. The same thing happens if I create a standard user account and run the program from there.

Has anyone else seen that behavior? It's not being virtualized, and it appears that the UAC awareness tweak to the program's manifest (I'm using VS2005 here) is working because I get errors when I try to write to System32 instead of a file in VirtualStore.

I would just let it go and count my blessings, but this software won't just be running on my machine and I'd like to make sure it'll work in other environments.

Answer 1

The default permissions allow non-admin users to create directories in ProgramData, so the observed behaviour is as-expected.

Answer 2

Users are able to write to the ProgramData folder, because rights to create files and folders are granted to Users by default:

The same is true on Windows 7. Likely also true on Windows Vista.