Whether Login swaps a UAC-filtered token for its linked full token depends
on the account: the built-in Administrator is never filtered, domain
accounts' network logons are not filtered, and other local Administrators
members are. Log which happened, and any failure to get the linked token,
so a session running with fewer rights than expected can be explained from
the log.
Updates #4697
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I2c4e6a8b0d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c
Brad Fitzpatrick
4af62a85c1