How can I start an application to run as guest or to run with limited privileges under Windows 7?
The current user is an admin and I want to test the behaviour of the application while running with less rights.
I already know that it has some issues on other systems but I want to run it on my computer/account to debug it.
Hold shift key and right-click executable and select "Run as different user".
Apologies if your question was seeking a programmatic solution.
Related
Is there a way to create a user in the new Windows 10 implementation of bash so that I'm not running it as root, without having to create a different user account in the Windows 10 system? I want to use Windows as an administrator with my normal user account but when I launch bash I want it to launch into an account other than the default account, which I'm guessing is automatically root (in the Linux subsystem) since it's the administrator account (in the Windows system).
WSL is specially designed not to compromise the normal Windows security, and it is (currently) "client-only". Thus, the "root" inside a WSL session is just simulation to make things look more real for stuff you run in the "Linux" environment. From the Windows point of view, root in WSL is the same user which launched the WSL. If this user is an elevated admin, the WSL programs are too.
For details, see the few available Channel9 videos and WSL blog.
To the original question - how to "drop" admin privileges for running WSL, see for example here.
When you install Bash on Windows the first time, you are prompted to create a (non-root) Linux account. When you start bash.exe, that is the account you are automatically logged in as.
Is there a way to find out what privileges my application needs in order to run in a Windows 7 environment?
I have a Delphi application that is using BDE and ODBC for database connectivity. This application works on most computers with Windows 7 running on a normal user account. However on some computers it only works on accounts with administrative privileges and is not working correctly on normal user accounts. I suspect it's a permission problem. The computers also are running in Active Directory.
I tried to find some informations using Process Monitor from SysInternals, however the output for me is too advanced. The process monitor log for two runs of my app (1. successful with administrative rights, 2. unsuccessfull on normal rights) had over 22k lines and i could not find the answer (needle) in the process monitor log (haystack).
What could i do to determine the privileges that my app needs in windows 7?
Use the Standard User Analyzer from the Microsoft Application Compatibility Toolkit.
The Standard User Analyzer (SUA) tool and the Standard User Analyzer
Wizard (SUA Wizard) both enable you to test your applications and to
monitor API calls in order to detect potential compatibility issues
due to the User Account Control (UAC) feature in the Windows® 7
operating system.
UAC, formerly known as Limited User Account (LUA), requires that all
users (including members of the Administrator group) run as Standard
Users, until the application is deliberately elevated, by using the
security prompt dialog box. However, not all applications can run
properly with the Standard User role, due to the application requiring
access and privileges for locations that are unavailable to a Standard
User.
Aaron Margosis has a tool called LUA Buglight that is designed to help track down issues related to privileges.
You can download the latest version from this blog post:
LUA Buglight 2.1.1 with support for Win7/2008R2 SP1
It is similar in concept to the MS Application Verifier. However, in practice I found LUA Buglight much easier to use and understand. Same with ProcessMonitor. It will monitor your process in a similar way but only report actions that failed as a normal user but succeeded as a admin user.
There is no documentation but it is simple to use. From the main GUI window select your Exe and let the BugLight program launch it. You need to be running in an Admin account with UAC enabled. Run your program though the steps that fail when you are not an admin. When you are done click on the Stop Logging button to see a report that lists what calls would have failed without admin rights.
Firstly I want to emphasize that I'm not trying to do anything "nasty" or "hackerish", nor am I trying to hide anything from user here.
During installations (using InstallShield LE) of my application user is prompted by Windows UAC to allow it to run in Administrator mode; If user accepts it - installation continues (standard behavior) and user again can check the option to add this program to autorun list (by adding a registry key to HKLM/../Run). All is fine and normal. But after every Windows restart, when this application starts, UAC kicks in and asks for user permission. Question is, how to avoid it, since it's a bit annoying (yet my app needs Administrator privileges to run)?
I mean user already granted such permissions on installation, so I cannot see a reason why it needs to be prompted on every startup? Moreover, I believe most antivirus software and such, also require elevated permissions to operate, but UAC doesn't prompt for it at Windows Startup.
Thank you for any advises, information, comments or solutions.
Does your application really need to start elevated? Or will it need to elevated access later when the user uses it to perform an action? If you can, drop the later admin task into a separate exe, allowing the main exe to start with no elevation - when you shellexecute the worker process later it will UAC on demand.
At install time, as you have noted, you have elevated the installer. If you want to run elevated code on subsequent runs, automatically, this is the point to install a service - which is what all those other apps you mentioned do.
You can't get around UAC for a process started in an interactive session. You could use a service running as a privileged user but you would be far better off finding a way to do whatever you do without requiring admin rights.
It's not possible for a program to run elevated without prompting. What you want to do is factor those portions of your application that need elevation into a windows service that runs as system. Then your autostarting application can make remoting calls to the service to delgate those activities that the user can't do without elevating.
Not done it but I found this article Selectively disable UAC for your trusted Vista applications that says use 'Application Compatibility Toolkit' from microsoft.
The Compatibility Administrator allows you to create a database of
compatibility fixes that will allow you to run certain applications
without an accompanying UAC.
Run the Compatibility Administrator as admin
select a new database template
Click the Fix button on the toolbar. When you see the Create New Application Fix wizard ... enter details about your app
Select a Compatibility Level
Select RunAsInvoker as the fix
It seems that the last one
Selecting the RunAsInvoker option will allow the application to launch
without requiring the UAC prompt.
Should do what you want provided that the invoker is admin and I think you can do this at start up using the scheduler : Create Administrator Mode Shortcuts Without UAC Prompts in Windows 7 or Vista
As you can see it runs your app in the compatibility mode which may or may not be acceptable for you.
I have a console application written in c#, which downloads a file to program files. So of course it needs to run as admin. This program gets called from a Win32 C++ application which almost certainly is not running as administrator
What are my options. How can I get this to work on UAC and non UAC enabled boxes ( I don't know if there needs to be separate solution in each case )
Oh and the console app is in .NET 2.0
On a machine with UAC you need to include a manifest resource to specify that you want the process to run as administrator.
On a machine without UAC you will simply have to instruct your users that they need to run it as a user in the administrators group. Almost all users of XP (the version that you will most commonly encounter without UAC) are in the administrators group so you won't encounter many problems.
I never tried it, but this can probably be done using the
CreateProcessAsUser Function.
This question already has answers here:
Disable Vista UAC per-application, or elevate privileges without prompt?
(3 answers)
Closed 9 years ago.
Is there a way to get my .exe file to execute with administrator rights instead of me
killing the LUA at registry or right click file and running as administrator?
When I alter the registry it prompts the user which I don't want. I am only adding the file to kill the LUA to give the user full rights to execute my .exe file.
If I can just get it to execute as administrator it would save me editing the registry. I can't find the source code for the application. It is coded in Delphi so it is a problem to add anything and the .reg file needs to be run with the .exe files on Windows Vista.
How can this issue be resolved?
You can't. If you could do it, any exe could to it and that would defeat the purpose of the UAC (assuming arguendo you believe there is a purpose for UAC). You can manifest your exe to require administrator privileges, but that will not stop the user prompt.
There are two proper ways to do this:
As already noted mark your exe as requiring elevated privilleges - the user will be prompted when starting your program, administrator privilleges and user confirmation are required.
Create a service running as LocalSystem that is allowed to do anything without prompting the user. In this case you have to implement interprocess communication mechanism for the service to communicate with user UI program, which may not be trivial. For this scenario your program has to be installed by administrator, but after that may be used by anyone - this is common for corporate scenarios.
Generally speaking Vista compatibility may not be easy to achieve and depending on your software may require a lot of work.
I'm not able to test this since I've only got XP with me at the moment...
Try creating a batch file with the runas command in it.
Note that the password will still need to be entered but it may save a couple steps.
If you just want to avoid the right-click and run as admin you can rename the exe to something like xyzSetup.exe.
There is (hopefully) no way that you can bypass the prompt, otherwise anyone can do it.
If you are just trying to avoid repeated prompts and don't mind being asked for the password or permission once, you could use runas with the /savecred option.
Generally this problem is solved by installing a Windows service which runs as SYSTEM or an administrator account. Then your application can request the privileged action from this service.
Obviously to not pose a security threat ensure that your service can't run arbitrary code or something which might leave the all users vulnerable to privilege escalation attacks.
WinPcap and most of the other sniffing applications use a similar design to give sniffing access to unprivileged users.
Install your service during the first run (or in the installer, which will require an UAC prompt).
I will have to read up on this but I don't have access to my source so this would be a problem.