UAC in Vista essentially introduced the idea of a &quot;split token&quot;. Administrators get two access tokens: a full access token, and a filtered access token. The filtered access token essentially is a standard user token and used by default. Only when elevating (UAC is prompted) is the full access token used (which is the filtered access token plus various admin-level privileges).<p>Each token has different privileges on what it allows&#x2F; doesn&#x27;t allow. One notable change in Vista was the introduction of SetTimeZonePrivilege, since in XP, you had to be an adminstrator in order to change the time.