title: What does mandatory integrity level value of 0x2010 stand for?
body: <p>I'm running the following snippet of code in my user-mode process that starts up when a Windows user account logs in to the workstation. Or, in other words, its path is placed in the <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</code> registry key.</p>
  
  <p>The code is supposed to determine the <a href="https://msdn.microsoft.com/en-us/library/bb625963.aspx" rel="nofollow">mandatory integrity level</a> of my user process. It goes as such:</p>
  
  <pre><code>DWORD getMIL()
  {
      //Try to get integrity level
      //-1                                            Unknown
      //SECURITY_MANDATORY_UNTRUSTED_RID              0x00000000 Untrusted.
      //SECURITY_MANDATORY_LOW_RID                    0x00001000 Low integrity.
      //SECURITY_MANDATORY_MEDIUM_RID                 0x00002000 Medium integrity.
      //SECURITY_MANDATORY_MEDIUM_PLUS_RID            SECURITY_MANDATORY_MEDIUM_RID + 0x100 Medium high integrity.
      //SECURITY_MANDATORY_HIGH_RID                   0X00003000 High integrity.
      //SECURITY_MANDATORY_SYSTEM_RID                 0x00004000 System integrity.
      //SECURITY_MANDATORY_PROTECTED_PROCESS_RID      0x00005000 Protected process.
      DWORD dwIntgtyLvl = -1;
  
      HANDLE hToken;
      if(OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &amp;hToken))
      {
  
          DWORD dwSizeIntgtyLvl = 0;
          if(!GetTokenInformation(hToken, TokenIntegrityLevel, NULL, dwSizeIntgtyLvl, &amp;dwSizeIntgtyLvl) &amp;&amp;
              ::GetLastError() == ERROR_INSUFFICIENT_BUFFER)
          {
              BYTE* pbIntgtyLvl = new BYTE[dwSizeIntgtyLvl];
              if(pbIntgtyLvl)
              {
                  TOKEN_MANDATORY_LABEL* pTML = (TOKEN_MANDATORY_LABEL*)pbIntgtyLvl;
                  DWORD dwSizeIntgtyLvl2;
                  if(GetTokenInformation(hToken, TokenIntegrityLevel, pTML, dwSizeIntgtyLvl, &amp;dwSizeIntgtyLvl2) &amp;&amp;
                      dwSizeIntgtyLvl2 &lt;= dwSizeIntgtyLvl)
                  {
                      dwIntgtyLvl = *GetSidSubAuthority(pTML-&gt;Label.Sid,
                          (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTML-&gt;Label.Sid)-1));
                  }
  
                  //Free mem
                  delete[] pbIntgtyLvl;
                  pbIntgtyLvl = NULL;
              }
          }
  
          ::CloseHandle(hToken);
      }
  
      return dwIntgtyLvl;
  }
  </code></pre>
  
  <p>In a normal flow of events I'd expect to get the value of <code>0x2000</code> for <code>SECURITY_MANDATORY_MEDIUM_RID</code>, or <code>0x3000</code> for <code>SECURITY_MANDATORY_HIGH_RID</code>, but if I have one Windows user account already logged in, and if I then switch users, and log in with another user account, the method above will get me the value of <code>0x2010</code> for the mandatory integrity level.</p>
  
  <p>Does anyone know what that value stands for?</p>