Finding Privilege Escalation Vulnerabilities in Windows Using Process Monitor

The article is using "program" more in the sense of a package -something that might contain multiple executables - rather than a single executable.

Mentioned a little after that sentence:

  These privileged components generally take two forms:
  - Installed services
  - Scheduled tasks

So another way to put the article text might be:

  When an application is installed on a Windows system, multiple executables may be installed. Some of these executables may be configured to run as part of a system service (akin to a *nix daemon) or scheduled task (similar to a cron job). Both system services and scheduled tasks may run with privileges separate from those of the currently logged on user.

Essentially, Windows services are equivalent to *nix daemons. Just like certain *nix daemons, Windows services are used to carry out more "system oriented" tasks (such as installing software updates), and can't necessarily run correctly with (possibly restricted) privileges of the currently logged in user. Furthermore, they may need to run regardless of whether a user is even logged in.

Scheduled tasks are similar to services in many aspects - they may require a static set of privileges, and may need to be run even when there is no currently logged in user. They just have the added requirement that they should be run at certain times or when certain events occur.

You can run some dlls as separate processes (manually using rundll32, or from another process). If you ask a privileged process to start these processes they can also have more privileges than you have yourself.

But you can’t have part of a process have more privileges than another part of that same process.

In this sentence "components" refers to system services or scheduled tasks which are part of a "program". Take "program" as the package you download and install.