Vista - Error - "A referral was returned from the server."

Hi,

I'm getting the above error when I run my application in Vista. If I disable
UAC, the application runs successfully.

Is there a workaround to this other than disabling UAC? Can this be done
through a manifest file? Any ideas?

Thanks,
Glenn

Glenn_97124,

Did you run the Desktop Program Compatibility Feature for testing your
personal application before installing?

Respectfully, perhaps the better method for resolving the conflict issue,
don’t run that application; or, don’t run Vista, your decision.

--
Firewall


"glenn_97124" wrote:

> Hi,
>
> I'm getting the above error when I run my application in Vista. If I disable
> UAC, the application runs successfully.
>
> Is there a workaround to this other than disabling UAC? Can this be done
> through a manifest file? Any ideas?
>
> Thanks,
> Glenn
>

What is your program doing when it receives this message?


--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

I get the message right after launching the program. I'm not exactly sure
where the problem occurs during the launch process.

My application is a test program that drives another application. One of the
first few things it does are:
- kills any running process of the app under test
- initialize current registry settings of the app under test
- checks display settings
- others

Appreciate your help.

Thanks,
Glenn

"Jimmy Brush" wrote:

> What is your program doing when it receives this message?
>
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/

Do you have a manifest on your application already? If so, please post the
manifest you are using. Also, have you changed any of the default UAC
settings in local security policy?


- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

See the manifest below. Also, I never changed the default UAC settings in
local security policy.

Thanks,
Glenn

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<asmv3:trustInfo xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
<asmv3:security>
<asmv3:requestedPrivileges>
<asmv3:requestedExecutionLevel level="asInvoker" uiAccess="true" />
</asmv3:requestedPrivileges>
</asmv3:security>
</asmv3:trustInfo>
</assembly>

"Jimmy Brush" wrote:

> Do you have a manifest on your application already? If so, please post the
> manifest you are using. Also, have you changed any of the default UAC
> settings in local security policy?
>
>
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>

Hello,

This error is comming up because you are attempting to execute an
application with uiaccess=true that has not been signed. Vista places the
following restriction on apps requesting uiAccess:

- They must have a trusted, valid digital signature
- If enabled by group policy (default), they must reside in a trusted
filesystem location (programfiles, windows)

uiAccess is intended only for accessibility applications, and may only
receive a windows logo thru a waiver.

If this is a product that is intended for external distribution, you should
look for a way to do what you need to do without needing uiAccess.

If this is an internal product that you use for testing, you can created a
new test-signing root certificate, add that root certificate to the "trusted
certificate" list, and then sign your app using that certificate.

NOTE: These instructions assume you have visual studio installed and are
using a command prompt that has all the environment variables set to find
SDK utilities such as makecert and signtool. If not, you will need to find
these tools on your hard drive before running them.

***

1) Open an elevated command prompt

- Click start
- Find Cmd Shell or command prompt
- Right-click, click Run As Administrator

2) Create a trusted root certificate

- Browse to the folder that you wish to contain a copy of the certificate
- In the command shell, execute the following commands:

makecert -r -pe -n "CN=Test Certificate - For Internal Use Only" -ss
PrivateCertStore testcert.cer

certmgr.exe -add testcert.cer -s -r localMachine root

3) Sign your file

- In the command shell, browse to the location of your exe
- In the command shell, type:

SignTool sign /v /s PrivateCertStore /n "Test Certificate - For Internal Use
Only" /t http://timestamp.verisign.com/scripts/timestamp.dll APP.exe

Where APP.exe is your application.

***

Don't forget about the default restriction of your program residing in a
trusted folder such as program files. With this restriction in place, your
app will run once it's signed, but if it's not in a trusted file system
location, it will not be able to use the uiAccess privilege. For testing
purposes, you may wish to disable this security feature:

- Click start
- Type: local security policy
- Press enter
- Expand Local Policies
- Click Security Options
- Double-click "User Account Control: Only elevate UIAccess applications
that are installed in secure locations"
- Click Disabled
- Click OK

Hope this helps!

--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

Thanks fro the info. I will try this out.

Also, do I have to do these steps in every Vista system? And the Vista
systems I need to test don't have VS. My development machine is on XP. Will I
be able to create the certificate on XP and then copy or install it on Vista?
Sorry for so many questions. This is my first time to do this.

Thanks again for the help.

"Jimmy Brush" wrote:

> Hello,
>
> This error is comming up because you are attempting to execute an
> application with uiaccess=true that has not been signed. Vista places the
> following restriction on apps requesting uiAccess:
>
> - They must have a trusted, valid digital signature
> - If enabled by group policy (default), they must reside in a trusted
> filesystem location (programfiles, windows)
>
> uiAccess is intended only for accessibility applications, and may only
> receive a windows logo thru a waiver.
>
> If this is a product that is intended for external distribution, you should
> look for a way to do what you need to do without needing uiAccess.
>
> If this is an internal product that you use for testing, you can created a
> new test-signing root certificate, add that root certificate to the "trusted
> certificate" list, and then sign your app using that certificate.
>
> NOTE: These instructions assume you have visual studio installed and are
> using a command prompt that has all the environment variables set to find
> SDK utilities such as makecert and signtool. If not, you will need to find
> these tools on your hard drive before running them.
>
> ***
>
> 1) Open an elevated command prompt
>
> - Click start
> - Find Cmd Shell or command prompt
> - Right-click, click Run As Administrator
>
> 2) Create a trusted root certificate
>
> - Browse to the folder that you wish to contain a copy of the certificate
> - In the command shell, execute the following commands:
>
> makecert -r -pe -n "CN=Test Certificate - For Internal Use Only" -ss
> PrivateCertStore testcert.cer
>
> certmgr.exe -add testcert.cer -s -r localMachine root
>
> 3) Sign your file
>
> - In the command shell, browse to the location of your exe
> - In the command shell, type:
>
> SignTool sign /v /s PrivateCertStore /n "Test Certificate - For Internal Use
> Only" /t http://timestamp.verisign.com/scripts/timestamp.dll APP.exe
>
> Where APP.exe is your application.
>
> ***
>
> Don't forget about the default restriction of your program residing in a
> trusted folder such as program files. With this restriction in place, your
> app will run once it's signed, but if it's not in a trusted file system
> location, it will not be able to use the uiAccess privilege. For testing
> purposes, you may wish to disable this security feature:
>
> - Click start
> - Type: local security policy
> - Press enter
> - Expand Local Policies
> - Click Security Options
> - Double-click "User Account Control: Only elevate UIAccess applications
> that are installed in secure locations"
> - Click Disabled
> - Click OK
>
> Hope this helps!
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>

> Thanks fro the info. I will try this out.

You're welcome

> Also, do I have to do these steps in every Vista system?

You use the makecert line to create the certificate file - this is only done
ONCE.

Then, on each Vista machine, you will need to do issue the certmgr line to
import the certificate you created into the trusted root certification
authority. Again, this must only be done on computers internal to your
company - it is NOT acceptable to do this on computers outside of your
company.

Finally, you only need to sign your app once (after it is created).

> And the Vista
> systems I need to test don't have VS. My development machine is on XP.
> Will I
> be able to create the certificate on XP and then copy or install it on
> Vista?

Yes, you can create the certificate and sign the app with the certificate on
XP. However, you will need to install the certificate you created into the
trusted root certification authority on each vista computer you want your
app to run on (this is what the certmgr line in my instructions does).

> Sorry for so many questions. This is my first time to do this.
>
> Thanks again for the help.

No problem


--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

I tried this out:
- successfully created the the certificate file on my XP dev machine
- successfully signed the my App on my XP machine

Then on the Vista machine:
- I get the following an error message:

C:\Windows\system32>C:\Users\palomag\Desktop\certmgr.exe -add testcert.cer
-s -r localMachine root
Error: Failed to open the source store
CertMgr Failed

By the way, I copied certmgr.exe from my XP to Vista. I don't have VS in my
Vista.

Thanks for the help.

"Jimmy Brush" wrote:

> > Thanks fro the info. I will try this out.
>
> You're welcome
>
> > Also, do I have to do these steps in every Vista system?
>
> You use the makecert line to create the certificate file - this is only done
> ONCE.
>
> Then, on each Vista machine, you will need to do issue the certmgr line to
> import the certificate you created into the trusted root certification
> authority. Again, this must only be done on computers internal to your
> company - it is NOT acceptable to do this on computers outside of your
> company.
>
> Finally, you only need to sign your app once (after it is created).
>
> > And the Vista
> > systems I need to test don't have VS. My development machine is on XP.
> > Will I
> > be able to create the certificate on XP and then copy or install it on
> > Vista?
>
> Yes, you can create the certificate and sign the app with the certificate on
> XP. However, you will need to install the certificate you created into the
> trusted root certification authority on each vista computer you want your
> app to run on (this is what the certmgr line in my instructions does).
>
> > Sorry for so many questions. This is my first time to do this.
> >
> > Thanks again for the help.
>
> No problem
>
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>