Why does Invoke-WScriptBypassUAC fail on Windows 8 and Windows 10?

On Windows 8, the technique fails because the system uses embedded manifests for executables, so placing an external `.manifest` file in the same directory does not override execution behavior. On Windows 10, both embedded manifests are used and `wusa.exe` no longer allows extracting files to protected directories like `C:\Windows` under standard user privileges. This limitation is emphasized in the [analysis of Invoke-WScriptBypassUAC](/news/analysis-of-invoke-wscriptbypassuac-exploitation-in-empire).