Managing privilege delegation on a computer device

A method of managing privilege delegation to control creation of processes on a computer device, the method being implemented by hardware of the computer device including at least a processor and a memory, the method comprising:

• intercepting, by an agent cooperating with an operating system of the computer device, a request from a user account of a logged-in user on the computer device to create a process according to first privileges in the user account on the computer device and obtaining information related to the request;
• determining, by the agent, whether to create the process in the user account on the computer device according to second privileges different from the first privileges, based at least in part on the obtained information, comprising hooking a query provided by the operating system to identify whether a user account control service cooperating the operating system is enabled, enquiring of the operating system whether to create the process in the user account on the computer device according to the second privileges whereupon the hooked query is invoked and confirming, in response to the invoked hooked query, that the user account control service is enabled;
• and
• causing, by the agent, the process to be created according to the second privileges in the user account by the operating system on the computer device, if it is determined to create the process in the user account on the computer device according to the second privileges.

A tangible non-transitory computer-readable storage medium having recorded thereon instructions which, when implemented by hardware of a computer device including at least a processor and a memory, cause the computer device to:

• intercept, by an agent cooperating with an operating system of the computer device, a request from a user account of a logged-in user on the computer device to create a process according to first privileges in the user account on the computer device and obtaining information related to the request;
• determine, by the agent, whether to create the process in the user account on the computer device according to second privileges different from the first privileges, based at least in part on the obtained information, comprising hooking a query provided by the operating system to identify whether a user account control service cooperating the operating system is enabled, enquiring of the operating system whether to create the process in the user account on the computer device according to the second privileges whereupon the hooked query is invoked and confirming, in response to the invoked hooked query, that the user account control service is enabled;
• and
• cause, by the agent, the process to be created according to the second privileges in the user account by the operating system on the computer device, if it is determined to create the process in the user account on the computer device according to the second privileges.