Windows 上電腦操作 Agent 點擊提升權限視窗無效的原因

Your agent drives Windows fine all day. Then it reaches Task Manager, an elevated terminal, Registry Editor or an installer, and everything stops working at once: the element list comes back empty, the click tool returns "ok", and nothing on screen moves. The screenshot still shows the window perfectly.

That is not the model and usually not a bug in your MCP server. It is User Interface Privilege Isolation (UIPI), and like most Windows security boundaries it fails silently.

What UIPI blocks

Every Windows process runs at an integrity level. A normal process, including one started by an account that is in the Administrators group, runs at Medium: UAC filters the admin rights out of the token. Anything started with "Run as administrator" runs at High.

UIPI stops a lower-integrity process from driving a higher-integrity one:

• Synthetic input. SendInput into a higher-integrity window is dropped. Microsoft's own docs for SendInput say that neither the return value nor GetLastError tells you the failure was caused by UIPI. Your tool reports success because, as far as the API is concerned, it was one.
• Window messages. PostMessage / SendMessage of most messages to an elevated window are blocked too, so the "click via message" fallback many tools use fails the same way.
• UI Automation. A Medium client cannot read the UI tree of an elevated app, so element discovery returns nothing. This is the symptom that usually shows up first.

What still works: capturing the screen. A Medium process can take a screenshot of an elevated window, which is why the agent can describe the window it cannot touch.

A public bug report on another open-source agent shows the exact pattern: screenshots fine, 0 elements, click returns ok: true with no effect, agent at Medium, target elevated. It is not specific to any one tool. Every desktop agent that does not run elevated hits it.

Check it in thirty seconds

1. The agent side. In the terminal or app that launches your agent:

   whoami /groups | findstr /i "Mandatory"

Medium Mandatory Level = normal. High Mandatory Level = elevated.

1. The target side. Task Manager > Details, right-click a column header > Select columns > Elevated. Any target with "Yes" there is out of reach for a Medium agent.

If the agent is Medium and the target is elevated, you have found the problem.

Fixes, in the order we would try them

1. Don't elevate the target. Most of the time it does not need it. The usual culprit is a terminal or IDE that was set to always run as administrator (Properties > Compatibility, or a shortcut's Advanced settings). Turn that off and the agent can drive it again.
2. Run the agent host elevated, on purpose. Start the terminal or MCP client with "Run as administrator" so the agent runs at High too. Be honest with yourself about what this means: everything the agent does now runs with admin rights. Do it for the one task that needs it, not as your default.
3. uiAccess, if you ship the tool. An app whose manifest sets uiAccess="true" may drive higher-integrity windows, but only if it is signed with a trusted certificate and installed in a protected location such as Program Files. That is how screen readers do it. It is not something you switch on for a script in your home folder.

What none of these fix: UAC prompts. The "Do you want to allow this app to make changes" dialog appears on the secure desktop, which no ordinary process can see or click. That is by design. An agent should stop and ask you there, not try to work around it.

A short pre-flight before you blame the model

• Screenshot fine, element list empty, clicks "ok" but ignored -> check elevation first.
• Agent at Medium, target "Elevated: Yes" -> un-elevate the target, or elevate the agent for that one task.
• A UAC prompt is up -> the agent cannot answer it. You do.

Why we care

We build Auten, an MCP server that gives Claude Code, Codex, Cursor or any MCP client hands on a real screen: your computer (Mac, Windows, Linux) and your Android phone (beta). On Windows it installs per user without admin rights, so by default it runs at Medium integrity and this rule applies to it exactly like to every other non-elevated tool. Setup is at auten.ai/mcp.

If you have hit a Windows case where an agent sees a window but cannot touch it and elevation was not the cause, describe it in the comments. We collect these.