I have an Inno Setup installer that needs to restart the explorer (in order to install a shell extension). During installation, I can start explorer.exe with ShellExecAsOriginalUser so that it doesn't start with admin privileges; this is important on Windows 8, because running explorer with admin privileges prevents Metro apps from running.
The trouble is that this function can't be called during uninstall, as stated in the documentation (I tried to do it anyway, but of course it fails). I don't understand why it's not possible. Any clue? Is there a workaround?
It cannot be called during uninstall because the Programs and Features control panel always starts the uninstaller with elevated permissions (when running a per-machine uninstaller, anyway); the "original user" is therefore still the admin user.
In this situation, probably the correct thing to do is to just use the latest version of Inno -- this includes Restart Manager functionality which should automatically sort Explorer out without you having to do anything.
Related
When users try to uninstall their own single user installation (for example installed using lowestprivileges none and HKCU entries) with 'Add/Remove Programs' in the Control Panel, everything works fine (that is, non-admin users can uninstall their own non-admin installation).
However the uninstaller will be elevated, when users start it from 'Apps & features' (Windows 10).
This seems to be a known Windows 10 bug:
How to prevent uninstaller elevating for Standard Windows 10 user?
Is there a way to work-around this issue when the Inno Setup uninstaller is started from 'Apps & features'?
Link this NSIS Workaround for Windows uninstaller elevation bug.
You will have to do exactly what that NSIS hack does.
Find out what is the Windows GUI user (and assume that you should uninstall as that user). Alternatively, you can store the username into some file in the installation folder.
Re-execute the installer as that user. That hack uses StdUtils NSIS plug-in with its ExecShellAsUser function. Maybe the DLL can be used from Inno Setup. If not, you can at least reuse its code.
All this is imo to much to ask in a single question. If you have specific problems, consider asking more specific questions.
Simpler alternative would be to prevent the uninstallation, when executed as different user, and show a suggestion to the user to go to Control panel instead.
For a similar question, see Uninstaller trouble with standard Windows user.
We have legacy desktop native app with custom setup. The setup is signed and must be run as administrator. Current prod setup EXE that was built and signed 5 years ago is automatically elevated and run as admin on Windows 7 or 8. The setup we rebuilt now and is also signed with different cert and has the same name as old one is not automatically elevated to admin and therefore fails.
What makes Windows to run the setup EXE automatically as admin?
Signing is not related to admin privileges, so don't worry about it in that respect.
To expand on Harry Johnson's comment (which is correct), early versions of UAC on Windows used to automatically elevate programs that looked like setup programs. I don't know the exact algorithm used, but programs with setup or install in the names or descriptions were elevated. That doesn't happen any more, and on UAC programs run by admins are not elevated unless they explicitly elevate with a manifest or a run as administrator.
Without knowing where that setup.exe comes from, if you build it. or it comes with a version of a setup tool (Visual Studio?) then it's hard to say how to fix it.
If this happens to be an MSI-based install then the MSI will ask for elevation if it's marked that way. It's not clear from the question which part of the setup requires elevation, but if it's setup.exe that actually does the install, then all of it needs elevation and it needs an elevation manifest.
Firstly I want to emphasize that I'm not trying to do anything "nasty" or "hackerish", nor am I trying to hide anything from user here.
During installations (using InstallShield LE) of my application user is prompted by Windows UAC to allow it to run in Administrator mode; If user accepts it - installation continues (standard behavior) and user again can check the option to add this program to autorun list (by adding a registry key to HKLM/../Run). All is fine and normal. But after every Windows restart, when this application starts, UAC kicks in and asks for user permission. Question is, how to avoid it, since it's a bit annoying (yet my app needs Administrator privileges to run)?
I mean user already granted such permissions on installation, so I cannot see a reason why it needs to be prompted on every startup? Moreover, I believe most antivirus software and such, also require elevated permissions to operate, but UAC doesn't prompt for it at Windows Startup.
Thank you for any advises, information, comments or solutions.
Does your application really need to start elevated? Or will it need to elevated access later when the user uses it to perform an action? If you can, drop the later admin task into a separate exe, allowing the main exe to start with no elevation - when you shellexecute the worker process later it will UAC on demand.
At install time, as you have noted, you have elevated the installer. If you want to run elevated code on subsequent runs, automatically, this is the point to install a service - which is what all those other apps you mentioned do.
You can't get around UAC for a process started in an interactive session. You could use a service running as a privileged user but you would be far better off finding a way to do whatever you do without requiring admin rights.
It's not possible for a program to run elevated without prompting. What you want to do is factor those portions of your application that need elevation into a windows service that runs as system. Then your autostarting application can make remoting calls to the service to delgate those activities that the user can't do without elevating.
Not done it but I found this article Selectively disable UAC for your trusted Vista applications that says use 'Application Compatibility Toolkit' from microsoft.
The Compatibility Administrator allows you to create a database of
compatibility fixes that will allow you to run certain applications
without an accompanying UAC.
Run the Compatibility Administrator as admin
select a new database template
Click the Fix button on the toolbar. When you see the Create New Application Fix wizard ... enter details about your app
Select a Compatibility Level
Select RunAsInvoker as the fix
It seems that the last one
Selecting the RunAsInvoker option will allow the application to launch
without requiring the UAC prompt.
Should do what you want provided that the invoker is admin and I think you can do this at start up using the scheduler : Create Administrator Mode Shortcuts Without UAC Prompts in Windows 7 or Vista
As you can see it runs your app in the compatibility mode which may or may not be acceptable for you.
I'm marking this as a community wiki because I'm not really looking for one complete answer. So if you feel like posting one or two things that will activate the UAC prompt instead of a comprehensive list then go ahead.
What actions in Windows will activate UAC? I'd like to avoid it as much as possible because my application doesn't need admin privileges. And I'm sure many other people want to avoid it.
Specifically, I would like to know if reading from the registry would activate it. Or writing to it?
You don't need to address the above question, just anything that will activate it is fair game.
It's really hard to Google anything about UAC because you get bombarded with articles about how to disable it. And I'd rather not have my application make the assumption UAC is disabled.
Nothing "activates" UAC.
If your application would fail to run as a standard user under Windows XP it will fail to run under Windows Vista or Windows 7 as a standard user.
What you are really asking is: what actions can a standard user not perform under Windows?
The things a standard user cannot do are pretty well known (they've been the same since Windows 2000). The main ones are:
modify anything in HKEY_LOCAL_MACHINE
modify anything in the Windows directory
modify anything in the Program Files folder
If you try to do any of those they will fail on:
Windows 2000
Windows XP
Windows Vista
Windows 7
Nobody should have been running as an administrator for day-to-day computer use. If your application did any of those bad things in Windows XP it would fail. The user would have to:
logon (or fast user switch) to an administrator
perform the administrative task
switch back to their real account
UAC is a convience mechanism, allowing you to easily temporarily switch to an administrator. Nothing you do will "trigger" it; you have to make it happen.
If you know your code needs to modify a file in C:\Program Files\My App\Data, then you should add a button on your form that will trigger the elevation.
You then need to launch an (elevated) copy of your program, do the thing, and close.
I created a launch4j installer (an exe-wrapper for java programs) and named it "MyApp.exe". It doesn't need any admin authentication. It just runs fine without any UAC prompt.
BUT: If I rename this installer to "install.exe" or "setup.exe", the UAC icon appears and I get a UAC promp when starting the installer.
Seems as if there are some "reserved words" in filenames that cause windows to start a program with elevated rights (UAC).
I'm writing an NSIS installer and the setup program elevates "as administrator" as needed on Windows 7 / vista.
I need to run the installed program at the end of the install and don't want to launch it with the same privileges as the installer.
The regular NSIS exec commands run the child process with the same permissions as the installer.
There is a UAC plugin for NSIS, but the documentation on it isn't great and it seems v. new; I'd prefer not to use that plugin.
Ideally, I'm looking for a small .exe I can include that'll launch the target program without UAC elevation. Does this exist?
Any other suggestions?
Thanks!
You only have two options:
Uncheck and remove the run checkbox (When running on NT6+)
Use the UAC plugin (It is not that new, but it is a pain to use, so I would suggest you just go for the first option)
There is no external program you can use since it is impossible to get back to the original user from a elevated process (You can try, and get pretty close, but it will not get the correct user in every case)
I found the following, which could be wrappered into a a simple command line utility:
http://brandonlive.com/2008/04/27/getting-the-shell-to-run-an-application-for-you-part-2-how/
It only took about an hour to get that code working for my project, and it works flawlessly so far. ;)