0

I am running an application installer in Windows 10. Its manifest says it should be run with Administrator privileges. If I run the application with the environment setting __COMPAT_LAYER=RunAsInvoker the application should run as the invoking user and no longer request elevation. This works in many cases, however there are several cases in which the application starts and then immediately pops up the UAC dialog.

Just to be 100% clear:

  • I have set __COMPAT_LAYER=RunAsInvoker when starting the application. This usually works but, in some cases, the application still asks for elevation.

  • I have set the security policy User Account Control: Detect application installations and prompt for elevation to DISABLED (I thought this was going to be the real fix, but no).

  • I DO NOT want the application to run with admininstrator privs. It doesn't need to do anything that would require admin and, if it did, I want it to just try and fail.

  • The application is not popping up its own messagebox (example, checking if it can write to %ProgramFiles% and then showing me a custom message. It's the UAC prompt on the secure desktop).

Why does this happen? Can an application keep requesting elevation despite the "RunAsInvoker" option?

How can I get the application to just run with the current user's token and simply fail if it has insufficient permissions?

Note that I haven't been able to find any answers beyond the __COMPAT_LAYER=RunAsInvoker setting.

Improve this question
4
  • UAC is triggered by a technology called "Windows Resource Protection" which in most cases will pop UAC up whenever a resource that the user doesn't have access to is touched. so for instance if the installer installs a service, that requires admin, with or without UAC. UAC isn't the problem, its the solution to you not being able to access a given object. that the object is inaccessible to the user is not UACs doing.
    – Frank Thomas
    Aug 4 at 20:49
  • This seems like a valid think to do. e.g. Getting an installer to install to a different directory or drive. It is perfectly simple and normal to do in Gnu/Linux using containers (e.g. docker).
    – ctrl-alt-delor
    Aug 4 at 20:53
  • @FrankThomas Stuff protected by Windows Resource Protection would also not be touchable by an installer running as admin, that’s sort-of the entire point. It is unrelated and also does not magically trigger UAC prompts.
    – Daniel B
    Aug 5 at 7:09
  • use Windows sandbox instead
    – phuclv
    Aug 6 at 2:31

2 Answers 2

Reset to default
2

Why does this happen? Can an application keep requesting elevation despite the "RunAsInvoker" option?

Yes. Simple as that. It can detect it is not elevated and then re-launch itself with elevation. This will trigger the UAC prompt.

You cannot stop this behavior without modifying the program or making use of a hidden parameter or the like already built into the program.

Improve this answer
2
  • "It can detect it is not elevated": this is exactly the behaviour I'm trying to mask or otherwise get around, even if it requires a 3rd party application. Unfortunately, "you can't" may very well be a valid answer to my question. However, before I accept this as the answer, I was wondering if you could add a link in your answer to some documentation about this behaviour (maybe about detecting if you are running as an elevated process). Maybe a dip into the doc may show a way around the check.
    – succulent_headcrab
    Aug 5 at 22:11
  • __COMPAT_LAYER isn’t documented in the first place. If you want to know how I start programs as admin anyway, that’s easy: Using ShellExecuteEx with the runas “verb”. The only way to suppress that would be to intercept this function, an advanced “hacking” technique.
    – Daniel B
    Aug 6 at 13:28
1

Lets hypothetically say that for you to do your job, you need access to room Maintenance Room. You go there, but the door is locked.

You go to your manager and say that the door is locked and that you now cannot do your job. The manager asks you for your clearance level, but you don't want to show it to your manager, because you expect him to know that you should be allowed in there.

Moral of the story, it doesn't matter if you trick the app thinking it has rights when it really doesn't. It needs those rights to perform administrative functions and without it, it will fail, just in a different way.

In your case, it is likely that the installer either writes to a registry or disk location the user does not have write access to, such as HKEY_LocalMachine or C:\Program Files. In all cases where an action is performed that the user does not have access too, a UAC prompt will appear to gain access to perform that action.

Either ensure that the installer does not write to these locations or live with the fact that your installer requires elevation.

Improve this answer
7
  • Following your analogy, I do not need access to the Maintenance Room, I am just asking for it to be unlocked without good reason As for the write access limit, I want to see "Access Denied" IF permission is denied. You should also read about the following before assuming what happens in this case: User Account Control: Virtualize file and registry write failures to per-user locations
    – succulent_headcrab
    Aug 4 at 20:05
  • You are asking your boss: "Unlock the door please" and your boss asks for your permission level, but not letting you in. Instead, you should ask your boss: "Can I go to the maintenance room?" He would say no, but no fuss about it. EG: Your installer should do checks. Checks will not raise UAC dialogs. Trying to perform the function and hope for an error will. If you want to see an Access Denied error, you must actually program that in yourself: if ( writeaccess(location) != $true) { throw "Access Denied"; }
    – LPChip
    Aug 4 at 20:30
  • This seems like a valid think to do. e.g. Getting an installer to install to a different directory or drive. It is perfectly simple and normal to do in Gnu/Linux using containers (e.g. docker).
    – ctrl-alt-delor
    Aug 4 at 20:51
  • This description is not entirely accurate. Attempting to perform operations that require more rights will not result in a UAC dialog. Indeed, running processes cannot be elevated. They will simply get “access denied” errors.
    – Daniel B
    Aug 5 at 6:40
  • @DanielB it depends on how it is written. Installers do checks before the execution and present an UAC dialog and .net programming language will do so too if their functions are used.
    – LPChip
    Aug 5 at 6:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.