1

I noticed that while using pip to install packages globally, the install failed with an insufficient permission error. When running pip as administrator, the problem was fixed and pip was able to write to my Program Files directory. The same behavior occurs when editing text files in Program Files -- it only works if I run the text editor as administrator.

However, far as I know, I have never run any installer programs as administrator, yet they all wrote to my Program Files directory without any kind of prompt. What allows these installers to bypass the security check?

(I do have UAC disabled, but if that's the cause then why can't pip and other normal programs like text editors write to the Program Files directory?)

2
  • This is security feature. Permissions on system folders doesn't allow modify it without elevated permissions. If you turn UAC back on, then installers will pop up a confirmation windows too. M$ assumes if file name containing word Setup then it should run as administrator.
    – Alex
    Feb 14, 2017 at 16:20
  • moving slider down, no longer disables UAC since win8, because the store apps require an activated UAC. Feb 14, 2017 at 16:29

1 Answer 1

2

When the UAC slider is all the way down, programs that ask for elevation will automatically be approved. That's distinct from all programs being elevated all the time (which is effectively what you get if you completely disable UAC, which would break things).

Programs can specify their elevation behavior in their manifest. Most programs run asInvoker, at the same level as the calling process. Some, like the Registry Editor and MMC, ask to be run with the highestAvailable permissions, so with UAC on, admins would get an elevation prompt but normal users wouldn't. Others, like most setup programs, are completely useless without elevation and therefore requireAdministrator. That's why setup programs are automatically elevating for you. Evidently, pip is not manifested as requiring elevation. "You have not because you ask not."

Bonus demonstration: one way to start an elevated program from the command line is PowerShell's Start-Process with -Verb runas, like this:

Start-Process cmd -Verb runas

With UAC on, running that will give you an elevation prompt for the command prompt. With UAC lowered to the minimum allowed by the UI, you get an elevated command prompt with no UAC dialog. (You can see the difference in the command window's title bar.) Had the -Verb runas been left off, you would have just got a normal command prompt.

2
  • Ah, I was unaware that there was a difference between "all the way down" and "completely off" (IIRC they were the same on Win7). Thanks!
    – Andrew Sun
    Feb 15, 2017 at 18:41
  • @AndrewSun I explained you why this is a diff in my comment Feb 16, 2017 at 5:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .