A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account (for which UAC disabled by default), service account or local system account. Contributor jboelter commented Jan 30, 2023 procmon trace (screenshot) of the loop on latest ...