Prevent elevation (UAC) for an application that doesn't need it [duplicate]

Question

Having recently migrated from Vista 32bit to Windows 7 64bit, one of my programs now requires admin rights.

I use a rather exotic text editor (Crimson Editor). Although not designed for Vist/Win7 it worked well with Vista. But under Windows 7, the program executable gets this UAC shield added to its icon (even though the "Run as administrator" flag in the compatibility tab is not set) and prompts for elevation whenever I run it.

How does Win7 determine that this notepad-like application needs admin rights? How can I override this false heuristic?

Answer 1

No, the reason Crimson Editor does this is NOT because it is unsigned. (And this is not new to Win7). It is because the application manifest, which is embedded at compile-time, specifies requestedPrivilegeLevel="highestLevel".

According to this forum post, the Crimson Editor developers changed this in revision 237-241. They did this because the "Add Crimson Editor to shell context menus" feature requires admin privileges.

The long-term fix would be for the Crimson Editor developers to correct their application manifest. They should add themselves to the shell context menus during install, or at least tell users they have to manually run the app elevated (which is easy to do) instead of requiring it.

For all apps with requestedPrivilegeLevel="highestLevel" in their manifest (use Manifest View to view application manifests), you can use Microsoft's Application Compatibility Toolkit to shim the application with the RunAsInvoker fix, which forces the app to run with your standard user tokens.

For more information on how to use the Application Compatibility Toolkit, see this post about applying it to Crimson Editor, or general instructions.

Answer 2

I found that I had two application that had this problem. One had 'update' in the file name and the other had 'update' in the 'FileDecsription'. I simply removed the word 'update' from these two application and no more UAC warnings. I found the information under 'How UAC Works' - 'Installer Detection' at:

https://docs.microsoft.com/en-us/previous-versions/aa905330(v=msdn.10)

Which states the following:

Installer Detection only applies to:

• 32 bit executables
• Applications without a requestedExecutionLevel
• Interactive processes running as a Standard User with UAC enabled

Before a 32 bit process is created, the following attributes are checked to determine whether it is an installer:

• Filename includes keywords such as "install," "setup," and "update."

• Keywords in the following Versioning Resource fields: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name.

• Keywords in the side-by-side application manifest embedded in the executable.

• Keywords in specific StringTable entries linked in the executable.

• Key attributes in the resource file data linked in the executable.

• Targeted sequences of bytes within the executable.

• Note: The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies.

Answer 3

If you have Visual Studio you can do the following:

1. Open Visual Studio as Administrator.
2. Press Ctrl-O to open a file
3. Browse to the folder where Crimson Editor is and open cedt.exe
4. The file is opened using the resource editor and you will see a tree with a branch named RT_MANIFEST, expand this and double-click the single child entry named "1 [English United States]"
5. About three quarters of the way down in the right column you will see requestedExecutionLevel level="highestAvailable", change "highestAvailable" to "asInvoker" (NB the editor opens in over-type mode by default.
6. Save the file and you're done.

HTH

Kevan

Answer 4

There is some information on the heuristics here: http://msdn.microsoft.com/en-us/library/aa905330.aspx

A manifest can help control some of these things.