Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there any way that I can force a program that normally requires administrator privileges (via UAC) to run without them? (ie: no UAC prompt and no system-wide access.)

Added: Without modifying the executable itself.


In spite of James's answer, I have found a few ways that it can almost be done:

  1. By modifying the executable I can remove the trustInfo entry from the manifest (or the manifest entirely, so I can use an external one), allowing the program to start without UAC. Unfortunately this modifies the executable, so it exits shortly after due to an internal checksum test.
  2. By using Process Explorer I can launch it as a Limited User. However this seems to limit it significantly more than I would like (it runs like Protected Mode IE and so can access significantly less than what my standard un-elevated user can).
share|improve this question
    
You specify not modifying the executable, yet modifying the .exe is one of your attempted ways? –  ekaj Apr 20 '12 at 4:39
    
@ekaj I only specified that after I found out that it wouldn't work ;) –  Andrew Russell Apr 21 '12 at 15:29
    
Could you maybe specify the program, even if you don't use it anymore? That might help people to know what it is trying to access that requires admin privileges –  ekaj Apr 21 '12 at 16:45
    
@ekaj Unfortunately not. However it's not especially relevant: UAC is triggered by a program asking for elevation during process creation (the usual way - as in this case - is with a manifest). Once a process is started, it cannot change its elevation status - no matter what restricted resources it tries to access. –  Andrew Russell Apr 22 '12 at 4:59
    
Aside from running via Process Explorer GUI, it's possible to run with psexec.exe -l. Sometimes it's better because it requires less manual actions. Still it will limit the process beyond "user" group permissions, as with process explorer's Run as Limited User. –  LogicDaemon Mar 29 at 9:59

7 Answers 7

up vote 24 down vote accepted
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\*\shell\forcerunasinvoker]
@="Run without admin rights (UAC)"

[HKEY_CLASSES_ROOT\*\shell\forcerunasinvoker\command]
@="cmd /min /C \"set __COMPAT_LAYER=RUNASINVOKER && start \"\" \"%1\"\""

Simple - add in context menu on app. file choice to run without administrative rights. In some cases - small amount 0.1% of programs may ask twice about UAC prompt.

Save in <name_of_file>.reg and add it to the Windows Registry.

share|improve this answer
1  
I used to use the Application Compatibility Toolkit shim, but that was a lot of work for each executable and left junk in the registry for each file as well. This method works and I like it a lot better. –  Ben Voigt Apr 17 '13 at 21:28
    
Accepting this as it seems to be the most straightforward method, and I've (finally!) been able to verify it. Also has the very nice property of being trivially usable as a once-off command line (remove the outer " and then turn \" into "). –  Andrew Russell Dec 29 '14 at 15:33
    
@Vom - Do you know of an easy way to get past programs that ask multiple times? Thanks! –  Derek Jan 6 at 16:25
1  
I have the same issue as @Derek, the application seems to constantly keep re-asking for UAC, I don't trust it with system wide access but I need its functionality.. –  Gizmo Mar 11 at 22:19
    
@Gizmo: I now use either a virtual machine as a sandbox or the program Sandboxie. You should still be monitoring all file changes and enable file-versioning/backups on windows to be safe. –  Derek Mar 12 at 0:44

I hope I'm not too late to the party, but I was looking for a similar question and without seeing an answer here I found out that Windows' builtin RunAscommand, when run as administrator, can do that with /trustlevel switch.

RUNAS /trustlevel:<TrustLevel> program

/showtrustlevels  displays the trust levels that can be used
                  as arguments to /trustlevel.
/trustlevel       <Level> should be one of levels enumerated
                  in /showtrustlevels.

This worked in my case. Ironically, starting a program explicitly without elevation requires an elevated command prompt. Go figure. :) I hope it helps you.

share|improve this answer
    
I can confirm this does not work. I just tested it and got an error: "RUNAS ERROR: Unable to run - (program name here). The requested operation requires elevation". –  user1258361 Dec 28 '14 at 3:21
1  
@user1258361 you have to run this command from elevated prompt, just like I wrote in bold... –  Mxx Dec 28 '14 at 4:01

I solved this problem today using the MS application customization toolkit.

I followed the instructions in a tech republic article: http://www.techrepublic.com/blog/window-on-windows/selectively-disable-uac-for-your-trusted-vista-applications/635

Basically:

1) you get the tookit from MS here .

2) Click Fix

3) Choose the RunAsInvoker option

4) Right Click the fix and choose Install

share|improve this answer
    
Your answer does exactly the opposite of the desired effect. Original question was how to force an app that asks for elevated privileges to run without elevating. Your answer still uses UAC but just disables that prompt. That's a wrong answer for this question. –  Mxx Jan 22 '14 at 14:07
    
@mxx actually no. If current user is limited (or you've got UAC enabled), then the process will launch with limited privileges altogether. –  LogicDaemon Mar 29 at 9:54
    
@LogicDaemon If you actually read the article, you'll see that it explains that if you follow those steps, you'll run an app as Administrator without UAC prompt. This is opposite of what OP asked for. –  Mxx Mar 29 at 14:35
    
@mxx nope. Read on technet what RunAsInvoker actually do. This is indeed what topicstarter asked for, though this only works for older apps. –  LogicDaemon Mar 30 at 11:53

I fixed this problem by going changing the permissions on the folder that contained the program.

I added each user that will run that program and gave them "full control" priviledges. That took care of the problem and I left the "run as admin" unchecked.

I don't have any security concerns for the users who will be running the program.

share|improve this answer

While in his question Andrew stated that the following did not quite work:

By modifying the executable I can remove the trustInfo entry from the manifest (or the manifest entirely, so I can use an external one), allowing the program to start without UAC. Unfortunately this modifies the executable, so it exits shortly after due to an internal checksum test.

I was able to modify an external .manifest file for the software I was using and change

<ms_asmv2:requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

to

<ms_asmv2:requestedExecutionLevel level="asInvoker" uiAccess="false" />

Turns out the software I was using did not really require administrator rights so I was able to run it on a Standard User account without UAC or administrator passwords. Thanks!

share|improve this answer

If a program has no manifest and refuses to run with no admin privileges, it is most likely due to UAC Installer Detection. I posted this question and misha256 has a good solution. I tested it and I can confirm that it works.

How to disable "Installer Detection" feature of UAC in Windows 7 Home Premium?

I did some research and I found that there is no reason for Installer Detection to exist.

Note that if the admin privileges are due to a trustinfo entry in a manifest, obviously this will not work.

share|improve this answer

No, if a program requires UAC then it is trying to access something outside of its sandbox. The program will not correctly run without the elevated access.

If you just want to get rid of the notification, you can disable UAC.

Disable UAC on Windows Vista: Start, type "user". Click on "User Accounts". On the window that pops up, click on "User Account Control Settings" and then Turn off UAC.

Disable UAC on Windows 7: Start, type "user". Click on "User Account Control Settings". Drag the choice bar all the way to the bottom to "Never Notify."

share|improve this answer
3  
Disabling UAC is not what I am trying to achieve. Also: your description of how UAC works is correct only in a general sense. It's possible for a program to request UAC when it doesn't strictly need it. And UAC happens before a program starts - once its running, if it steps beyond its permissions, it will simply get permission-denied errors. –  Andrew Russell Aug 4 '10 at 14:32
    
Semantics aside, you can't "disable" UAC notifications for a specific program while still limiting their access. –  James Watt Aug 4 '10 at 14:47
    
James: Actually - it looks like you can - I've updated my question. –  Andrew Russell Aug 4 '10 at 16:11
    
Short of modifying the program code itself, I would be interested to know of a working solution if you find one. –  James Watt Aug 5 '10 at 5:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.