title: Do high-integrity tokens *have* to have the Administrators group enabled?
body: <p>When UAC is enabled, and you log in with an administrative account, you get two tokens:</p>
  
  <ul>
  <li><p>the elevated token; this has the Administrators group enabled, is high integrity (i.e., the mandatory integrity label SID is S-1-16-12288) and has elevation type TokenElevationTypeFull.</p></li>
  <li><p>the limited token; this has the Administrators group disabled, is medium integrity (S-1-16-8192) and has elevation type TokenElevationTypeLimited.</p></li>
  </ul>
  
  <p>Do these three factors always match up in this way?  That is, does the kernel <em>require</em> that only tokens with the Administrators group enabled can have high integrity and/or TokenElevationTypeFull?</p>
  
  <p>Are there any circumstances under which a process will not have Administrators privilege but will be running with high integrity and/or TokenElevationTypeFull?</p>
  
  <p>(Rationale for the question: the answer affects the ways in which a programmer can safely test for elevated privileges.  For example, <a href="https://stackoverflow.com/a/30921854/886887">it came up here</a>.)</p>