2020-11-25 17:43

Support UI Automation within a Windows Defender Application Guard process

Summary of the issue:

On Windows 10 Enterprise, it is now possible to run Microsoft Edge within Windows Defender application Guard (WDAG). WDAG is a stripped-back version of Windows running in a special virtual machine that can securely isolate a process from the rest of the system. The only way that an asistive technology can talk to the isolated process is via UI Automation. Nothing else can cross the machine boundary. WDAG perfectly forwards the UI Automation implementation from the isolated process, but changes the processID property on each UIA element to expose the local WDAG process ID rather than the process ID inside the VM. However, the following two problems exist: * currently WDAG does not change the nativeWindowHandle property and therefore that property exposes handle values from the isolated process which are completely invalid on the local machine. * The local window that hosts the entire WDAG content does not report itself as having a native UIA implementation. These problems together mean that NVDA pretty much stays silent when focus is within a WDAG process and therefore if a user decides to run Microsoft Edge in this fassion it is completely inaccessible.

Description of how this pull request fixes the issue:

  • UIA NVDAObjects should never use their UIAElement's nativeWindowHandle as the NVDAObject's windowHandle. Rather they should always use UIAHandler.handler.getNearestwindowHandle. This was mostly already true, though sometimes nativeWindowHandle was still taking preidence if it existed.
  • UIAHandler.handler.getNearestWindowhandle: this function used to just find the first non-NULL nativeWindowHandle on a UIAElement and its ancestors. However now it also checks to see if the UIAElement is a WDAG UIAElement and if so then uses the root windowHandle for the process (which is the local windowHandle on this machine). In other words, all UIA NVDAObjects representing UIAElements within WDAG will now have a valid local windowHandle which is simply the root of the WDAG process.
  • UIAHandler.handler.isUIAWindow: if the window is a 'RAIL_WINDOW' then it should always be classed as being a UIA window. 'RAIL_WINDOW' is the window class given to the local window that hosts WDAG content.

These changes make NVDA function with Microsoft Edge in WDAG exactly the same way it would if Edge was running locally. The only difference being a noticeable drop in responsiveness.

Testing performed:

On a windows 10 Enterprise machine: * Went to Turn Windows Features On or Off, and selected Windows Defender Application Guard and pressed okay and rebooted etc. * Launched Microsoft Edge. * Whent to Settings and more -> New Application Guard window * In the new Microsoft Edge process that appeared, went to https://www.nvaccess.org/ * Read the page using browse mode, tab, quick navigation etc.

Known issues with pull request:

If the name of the WDAG process ever changes (it is currently hvsirdpclient), not only will the WDAG process be inaccessible, but most importantly NVDA and or other parts of the system may experience hans or crashes due to the use of a nativeWindowHandle from a remote machine that is not valid locally. I have suggested to Microsoft that this is a major risk. Note though that without this PR the risk still remains the same.

Change log entry:

New features: * Support for Microsoft Edge running within Windows Defender Application Guard


  • 点赞
  • 写回答
  • 关注问题
  • 收藏
  • 复制链接分享
  • 邀请回答


  • weixin_39860123 weixin_39860123 5月前


    For anyone commenting on this pull request, WDAG was announced in 2016, and introduced in Version 1709 (Fall Creators Update). Thus, tests should be done by other Windows Insiders running Windows 10 Enterprise or Education Version 1709 Preview. Thanks.

    点赞 评论 复制链接分享
  • weixin_39860123 weixin_39860123 5月前

    CC who uses Windows 10 Education, functionally equivalent to Windows 10 Enterprise.

    Edit: Removed quoted email.

    点赞 评论 复制链接分享
  • weixin_39787345 weixin_39787345 5月前

    It is also worth noting that several major UI Automation bugs in WDAG were fixed and are only available as of build 16288. In fact running WDAG with or with out this code on prior builds may cause hangs or crashes.

    点赞 评论 复制链接分享
  • weixin_39655160 weixin_39655160 5月前

    Is there some way that NVDA can query for the name of the WDAG process?

    点赞 评论 复制链接分享
  • weixin_39787345 weixin_39787345 5月前

    We can query the name of (a given) process. A WDAG process will have a name of "hvsirdpclient". There is no other way I know of to identify a process as a WDAG process apart from checking the name. Simply, I believe this UI Automation implementation is flawed as the nativeWindowHandle property does not expose a valid windowHandle as the spec promises.

    点赞 评论 复制链接分享