Vista - Configure App to Run As Administrator without prompting for password

"Jimmy Brush" <jb@mvps.org> wrote in message
news:ekevh13rHHA.4764@TK2MSFTNGP06.phx.gbl...
> <snip>
>> I never said they didn't. But you were arguing that the OP couldn't
>> possibly be seeing what he was experiencing, when I know from
>> personal experience that it *is* possible.
>
> I am not arguing over what the OP is seeing.

But you did:

Jimmy Brush wrote
> Neufusion wrote
>> They were able to play as Standard Users in XP. No admin rights.
>>
> Then they should be able to play on Vista without admin rights.
>

>
> I am just saying that the problem he is experiencing can only be
> resolved by the authors of the program,

Agreed, given that MS isn't likely to change Vista to accommodate it
(and I'm not arguing that they should, unless this really is a flaw /
bug. I think UAC and related security changes in Vista are steps in the
right direction, but I also think some aspects of the implementation
need some additional work).

> and is most likely caused by the program itself asking for admin
> power,

But from what the OP said, it really couldn't have been asking for admin
power or it would have been failing under an XP standard user account.
So unless the OP was mistaken (certainly a possibility) it has to be
some other scenario.

> although it could be a setup-detection issue like you said.
>
> I hadn't thought about the scenario you described, either... that
> would cause problems .

Tell me about it. It took me far too long to figure out why our app was
failing under a Vista standard user account but would work fine under an
XP standard user account. We didn't even have the clue of a UAC prompt
since the part of our app that was failing is a shell replacement, and
UAC is aparently a function of the Explorer shell... Sigh.

>
> In any case, the issue here is not that the program is failing to run
> as a standard user, it is that it is demanding to be ran by only an
> administrator.

Not sure I agree that the distinction applies in this case.

>
> However, continuing on our side-conversation about application
> compatibility with standard users in Vista...
>
> AFAIK, the file/registry security settings really haven't changed all
> that much from XP.
>
> Things like you can't write to program files or modify keys in
> HKEY_LOCAL_MACHINE - these are the big ones - have always been that
> way in XP as a standard user.
>
> That is why I called the apps stubborn, because it has never been
> acceptable to do those things in a non-admin app, even though a lot of
> developers did them anyway because they didn't know better or could
> get away with it
>
> I find it highly unlikely that a program that would run as a standard
> user in XP would not in Vista, although I am certainly not saying it
> is impossible, and would be interested in learning about specific
> instances of this happening.

Well, according to the OP, Battlefield 2142 is an example. I can't
confirm this, as I don't have that game. The only other example I know
of is the one I experienced with our application, in a scenario similar
to what I described in my previous post. Not a main-stream situation by
any means (our app is targeted at specific businesses), but I could see
variations on that theme cropping up in consumerland.

>
> As far as the rules on automatic setup recognition, you can find a
> summary of what is looked for here:
>
> http://technet2.microsoft.com/Window....mspx?mfr=true
>

I had seen that resource before, and it is what pointed me to the
solution to our app failing. Unfortunately, it isn't as definitive as
it really needs to be for developers since it doesn't fully define terms
"... keywords like "install," "setup," "update," etc. ..." - OK, that's
great, but "keywords like ... etc." implies there are others. What are
the other keywords? Given that those keywords are aparently checked in
a dozen or more places, it becomes critical to know what they are.

> I am not aware of any exhaustive list that details exactly what is
> done.

I would be happy with a comprehensive list of keywords to tell our
developers to avoid. "Update" was the one that caught us, fortunately
it was in that list. I shudder to think what would have happened if the
one we stumbled over hadn't been in that list. I might still be looking
for the problem.

Regards,

Dave

Dave R. wrote:
> "Jimmy Brush" <jb@mvps.org> wrote in message
> news:ekevh13rHHA.4764@TK2MSFTNGP06.phx.gbl...
>> <snip>
>>> I never said they didn't. But you were arguing that the OP couldn't
>>> possibly be seeing what he was experiencing, when I know from
>>> personal experience that it *is* possible.
>> I am not arguing over what the OP is seeing.
>
> But you did:
>
> Jimmy Brush wrote
>> Neufusion wrote
>>> They were able to play as Standard Users in XP. No admin rights.
>>>
>> Then they should be able to play on Vista without admin rights.
>>
>

I guess I didn't make myself clear there. What I meant was, if the
program did not ask for admin power and just ran as a standard user,
then it should work.

<snip>

>> and is most likely caused by the program itself asking for admin
>> power,
>
> But from what the OP said, it really couldn't have been asking for admin
> power or it would have been failing under an XP standard user account.
> So unless the OP was mistaken (certainly a possibility) it has to be
> some other scenario.

A program that "asks for admin power" on Windows Vista using a manifest
would run just fine on XP without admin power.

<snip>
> Tell me about it. It took me far too long to figure out why our app was
> failing under a Vista standard user account but would work fine under an
> XP standard user account. We didn't even have the clue of a UAC prompt
> since the part of our app that was failing is a shell replacement, and
> UAC is aparently a function of the Explorer shell... Sigh.

In order to launch an application that requires elevation you have to
launch it via ShellExecute.

So, if you were trying to start a program that UAC identified as a setup
program using CreateProcess, it would fail with ERROR_ELEVATION_REQUIRED.

The setup detection application compatibility hack certainly does carry
along with it some collateral damage.

>> In any case, the issue here is not that the program is failing to run
>> as a standard user, it is that it is demanding to be ran by only an
>> administrator.
>
> Not sure I agree that the distinction applies in this case.

You may be correct.

<snip>
> I would be happy with a comprehensive list of keywords to tell our
> developers to avoid. "Update" was the one that caught us, fortunately
> it was in that list. I shudder to think what would have happened if the
> one we stumbled over hadn't been in that list. I might still be looking
> for the problem.

I will see if I can dig into this a little more and come up with a
better list .

> Regards,
>
> Dave
>
>


--
-JB
Microsoft MVP - Windows Shell/User
Windows Vista Support FAQ - http://www.jimmah.com/vista/

> I will see if I can dig into this a little more and come up with a
> better list .
>

I dug into the Windows application compatibility database, which is
tasked with identifying "general" installer-type programs, and this is
the best list I could come up with:

Matches based on file names

*patch* (EXCEPT adpatch.exe, dispatch.exe, dispatcher.exe, and
WIDispatcher.exe)
*uninst*
*update*
*instal*
*setup*
UNWISE.exe
UNWISE32.EXE
artpschd.exe

Matches based on version information

COMPANY_NAME="*Update*"
COMPANY_NAME="*Instal*"
COMPANY_NAME="*Setup*"
PRODUCT_NAME="*Update*"
PRODUCT_NAME="WinSFX32* for Win32"
PRODUCT_NAME="*Instal*"
PRODUCT_NAME="*Setup*"
INTERNAL_NAME="TSULoader"
INTERNAL_NAME="*Update*"
INTERNAL_NAME="*Instal*"
INTERNAL_NAME="*Setup*"
16BIT_DESCRIPTION="STUB.exe" and 16BIT_MODULE_NAME="GLBSSTUB"
FILE_DESCRIPTION="RTPatch Executable"
FILE_DESCRIPTION="*uninst*"
FILE_DESCRIPTION="*update*"
FILE_DESCRIPTION="*Instal*"
FILE_DESCRIPTION="*Setup*"
ORIGINAL_FILENAME="stub32i.exe" (excluding some specific installshield
exe's)
ORIGINAL_FILENAME="*Update*"
ORIGINAL_FILENAME="*Instal*"
ORIGINAL_FILENAME="*Setup*"

Plus some translations into japanese that I can't type.

There are a boat-load of "exceptions" and specific installer-detection
rules in addition to these general rules that I didn't mention, because
they target a specific file from a specific vendor and you shouldn't be
able to hit those.

You can download the application compatibility toolkit and play with the
complete database yourself:

http://www.microsoft.com/downloads/d...displaylang=en

There is also a separate installer detection routine that lives inside
of Windows that detects specific installers that the application
compatibility shim engine can't handle detection for, but again these
are for specific installers so you shouldn't hit them.


--
-JB
Microsoft MVP - Windows Shell/User
Windows Vista Support FAQ - http://www.jimmah.com/vista/

"Jimmy Brush" <jb@mvps.org> wrote in message
news:umo2MM6rHHA.4180@TK2MSFTNGP04.phx.gbl...
>> I will see if I can dig into this a little more and come up with a
>> better list .
>>
>
> I dug into the Windows application compatibility database, which is
> tasked with identifying "general" installer-type programs, and this is
> the best list I could come up with:
>
> Matches based on file names
>
> *patch* (EXCEPT adpatch.exe, dispatch.exe, dispatcher.exe, and
> WIDispatcher.exe)
> *uninst*
> *update*
> *instal*
> *setup*
> UNWISE.exe
> UNWISE32.EXE
> artpschd.exe
>
> Matches based on version information
>
> COMPANY_NAME="*Update*"
> COMPANY_NAME="*Instal*"
> COMPANY_NAME="*Setup*"
> PRODUCT_NAME="*Update*"
> PRODUCT_NAME="WinSFX32* for Win32"
> PRODUCT_NAME="*Instal*"
> PRODUCT_NAME="*Setup*"
> INTERNAL_NAME="TSULoader"
> INTERNAL_NAME="*Update*"
> INTERNAL_NAME="*Instal*"
> INTERNAL_NAME="*Setup*"
> 16BIT_DESCRIPTION="STUB.exe" and 16BIT_MODULE_NAME="GLBSSTUB"
> FILE_DESCRIPTION="RTPatch Executable"
> FILE_DESCRIPTION="*uninst*"
> FILE_DESCRIPTION="*update*"
> FILE_DESCRIPTION="*Instal*"
> FILE_DESCRIPTION="*Setup*"
> ORIGINAL_FILENAME="stub32i.exe" (excluding some specific installshield
> exe's)
> ORIGINAL_FILENAME="*Update*"
> ORIGINAL_FILENAME="*Instal*"
> ORIGINAL_FILENAME="*Setup*"
>
> Plus some translations into japanese that I can't type.
>
> There are a boat-load of "exceptions" and specific installer-detection
> rules in addition to these general rules that I didn't mention,
> because they target a specific file from a specific vendor and you
> shouldn't be able to hit those.
>
> You can download the application compatibility toolkit and play with
> the complete database yourself:
>
> http://www.microsoft.com/downloads/d...displaylang=en
>
> There is also a separate installer detection routine that lives inside
> of Windows that detects specific installers that the application
> compatibility shim engine can't handle detection for, but again these
> are for specific installers so you shouldn't hit them.
>
>

Thanks much for the research and the link, this looks like it will help
make our efforts in Vista less painful. I'll pass the info along to our
development group.

Regards,

Dave

"Jimmy Brush" <jb@mvps.org> wrote in message
news:e5bof34rHHA.1172@TK2MSFTNGP03.phx.gbl...
> Dave R. wrote:
>> "Jimmy Brush" <jb@mvps.org> wrote in message
>> news:ekevh13rHHA.4764@TK2MSFTNGP06.phx.gbl...

<snip>

>
> A program that "asks for admin power" on Windows Vista using a
> manifest would run just fine on XP without admin power.

Did you mean "A program *that doesn't actually need admin power* that
"asks for admin power" on Windows Vista using a manifest would run just
fine on XP without admin power." ? If not, I guess I don't understand
how that could be.


>
> <snip>
>> Tell me about it. It took me far too long to figure out why our app
>> was failing under a Vista standard user account but would work fine
>> under an XP standard user account. We didn't even have the clue of a
>> UAC prompt since the part of our app that was failing is a shell
>> replacement, and UAC is aparently a function of the Explorer shell...
>> Sigh.
>
> In order to launch an application that requires elevation you have to
> launch it via ShellExecute.
>
> So, if you were trying to start a program that UAC identified as a
> setup program using CreateProcess, it would fail with
> ERROR_ELEVATION_REQUIRED.
>
> The setup detection application compatibility hack certainly does
> carry along with it some collateral damage.
>

Thanks for the explanation - and for agreeing that the setup detection
is at best a hack :-)

<snip>

>> I would be happy with a comprehensive list of keywords to tell our
>> developers to avoid. "Update" was the one that caught us,
>> fortunately it was in that list. I shudder to think what would have
>> happened if the one we stumbled over hadn't been in that list. I
>> might still be looking for the problem.
>
> I will see if I can dig into this a little more and come up with a
> better list .
>

Thank you for that, and I see that you have posted the results of your
research in another post.

Regards,

Dave

Dave R. wrote:
> "Jimmy Brush" <jb@mvps.org> wrote in message
> news:e5bof34rHHA.1172@TK2MSFTNGP03.phx.gbl...
>> Dave R. wrote:
>>> "Jimmy Brush" <jb@mvps.org> wrote in message
>>> news:ekevh13rHHA.4764@TK2MSFTNGP06.phx.gbl...
>
> <snip>
>
>> A program that "asks for admin power" on Windows Vista using a
>> manifest would run just fine on XP without admin power.
>
> Did you mean "A program *that doesn't actually need admin power* that
> "asks for admin power" on Windows Vista using a manifest would run just
> fine on XP without admin power." ? If not, I guess I don't understand
> how that could be.

Yes, that is what I mean. I know it sounds crazy, but I still think it
is the most likely scenario.

<snip>

>
> Thank you for that, and I see that you have posted the results of your
> research in another post.
>
> Regards,
>
> Dave
>
>

You're welcome .


--
-JB
Microsoft MVP - Windows Shell/User
Windows Vista Support FAQ - http://www.jimmah.com/vista/

"Jimmy Brush" <jb@mvps.org> wrote in message
news:Opft%235nsHHA.208@TK2MSFTNGP06.phx.gbl...
> Dave R. wrote:
>> "Jimmy Brush" <jb@mvps.org> wrote in message
>> news:e5bof34rHHA.1172@TK2MSFTNGP03.phx.gbl...
>>> Dave R. wrote:
>>>> "Jimmy Brush" <jb@mvps.org> wrote in message
>>>> news:ekevh13rHHA.4764@TK2MSFTNGP06.phx.gbl...
>>
>> <snip>
>>
>>> A program that "asks for admin power" on Windows Vista using a
>>> manifest would run just fine on XP without admin power.
>>
>> Did you mean "A program *that doesn't actually need admin power* that
>> "asks for admin power" on Windows Vista using a manifest would run
>> just fine on XP without admin power." ? If not, I guess I don't
>> understand how that could be.
>
> Yes, that is what I mean. I know it sounds crazy, but I still think it
> is the most likely scenario.
>

I agree it sounds crazy, but possible. Without further information from
the OP we may never know.

Regards,

Dave

>>
>> > When a normal (non-admin) user logs into my PC and tries to play, it
>> > pops up and asks for *MY* password to authorize access. I type in MY
>> > password, accept, and it works.
>>
>> > I just got a call on my cell phone - "Hey, I want to play BF2142, what
>> > is your password?". I dont want to give away my password. I want
>> > normal users to always be able to launch the application, even if I am
>> > not there to put my password in.
>>
>> > How can this be done?
>>
>> If the application requires that an administrator run the program, there
>> is nothing you can do short of making the users needing to run the
>> program an administrator.
>>
>
> So kids can't play current games unless they are a system
> administrator? Nice.
>
You can try the solution on www.robotronic.de/runasspcen.html
With that tool you can run an application in another user context.
The account information to run the application are reading from an encrypt
file.