Vista - How to declare a program as "trusted"

You can change the Windows integrity level as I understand and am currently
working with. Let me know if this makes sense to everyone:

http://www.minasi.com/vista/chml.htm

Check out the above link.

Users can change the integrity level of an object if they have the SeRelabel
Priveledge.

You can remove, edit and change the Windows integrity levels via this
command line program and write a new SDDL to the file. You can read the
mandatory levels with the vista command line tool ICacls ( I can run this
command from either an elevated command prompt or just the regular command
prompt, and I have been able to view Mandatory labels). You just need read
permission for the object in order to view the mandatory label.

Here is an example:

c:\users\wosully\appdata\locallow OSULLIVAN\wosullyF)
OSULLIVAN\wosullyOI)(CI)(IO)(F)
NT AUTHORITY\SYSTEMF)
NT AUTHORITY\SYSTEMOI)(CI)(IO)(F)
BUILTIN\AdministratorsF)
BUILTIN\AdministratorsOI)(CI)(IO)(F)
Mandatory Label\Low Mandatory
LevelOI)(CI)(N
--
MCSE: Security, CCNA, A+, Network +, Security+


"Jimmy Brush" wrote:

> Hello,
>
> You can make/change the manifest to tell Windows how much privilege the
> specific application needs; however, this won't allow you to always trust an
> application. If you specify in the manifest that the application needs
> administrator privileges then the system will prompt with UAC.
>
>
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>

The integrity level of an object controls what applications can modify that
object. Changing the integrity level of an .exe would control what
applications can modify the actual .exe file, not what integrity level the
application runs at.

Of course, if you are a programmer and researched it enough you could
probably make a program that implements some sort of "trust always"
functionality, but this functionality is not built in to windows and I
believe it would be doing a great disservice to users to make such a program.

--

- JB

Thanks for the explanation: this is much deeper with regard to security than
previous versions, and I agree with you: I woud love for this to make a
significant difference and maybe I wouldn't get so many people asking me to
help them with their personal machines and spyware. ;-)
--
MCSE: Security, CCNA, A+, Network +, Security+


"Jimmy Brush" wrote:

> The integrity level of an object controls what applications can modify that
> object. Changing the integrity level of an .exe would control what
> applications can modify the actual .exe file, not what integrity level the
> application runs at.
>
> Of course, if you are a programmer and researched it enough you could
> probably make a program that implements some sort of "trust always"
> functionality, but this functionality is not built in to windows and I
> believe it would be doing a great disservice to users to make such a program.
>
> --
>
> - JB
>

I have disabled UAC as I am fed up with not being able to add applicaions
which I trust :-(

Hello,

What applications do you run all the time that requires administrator
privileges? I would guess that either they really should not need admin
privileges, or they could be redesigned to reduce or eliminate prompts .

I think once the Vista-compatible applications are released, this will be
much less of a problem.


--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

I've got the same issue, and I'm willing to take the risk and allow SOME
programs to auto run with full privilages.

The one program I use that wants confermation EVERY time. Microsft Visual
Basic Express 2005

"Jimmy Brush" wrote:

> Hello,
>
> What applications do you run all the time that requires administrator
> privileges? I would guess that either they really should not need admin
> privileges, or they could be redesigned to reduce or eliminate prompts .
>
> I think once the Vista-compatible applications are released, this will be
> much less of a problem.
>
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>