Vista UAC - get app to request escalation for a task

[d-42]

Hi,

How do I ask for escalation from within a program?

I'm developing a standalone program that can also act as a 'plugin' to
another application. The way the other app was designed, it scans a
plugin folder in its "program files" folder for settings documents
which contain all the settings it needs to know to call the plug-in
apps.

The problem, of course, is permissions. Under vista, even the
administrator accounts are prevented from writing to the folder
without escalation.

So I how do I request escalation so that my program can save the
settings file to its plugin folder? right now it just throws an
exception 'access denied'. I'd be happy if I could get the 'The
program is trying to access a protected folder..." type of message
that they could just accept. After all, it only normally needs to be
done once.

As it stands now, it works if they launch the software using the 'run
as administrator', but I'd prefer it to ask on that one function
instead, if its not a buttload of work.

thanks in advance for any suggestions or advice,
-Dave

[Mr. Arnold]

"d-42" <db********@gma il.comwrote in message
news:d9******** *************** ***********@k36 g2000pri.google groups.com...

Hi,

How do I ask for escalation from within a program?

I'm developing a standalone program that can also act as a 'plugin' to
another application. The way the other app was designed, it scans a
plugin folder in its "program files" folder for settings documents
which contain all the settings it needs to know to call the plug-in
apps.

The problem, of course, is permissions. Under vista, even the
administrator accounts are prevented from writing to the folder
without escalation.

So I how do I request escalation so that my program can save the
settings file to its plugin folder? right now it just throws an
exception 'access denied'. I'd be happy if I could get the 'The
program is trying to access a protected folder..." type of message
that they could just accept. After all, it only normally needs to be
done once.

As it stands now, it works if they launch the software using the 'run
as administrator', but I'd prefer it to ask on that one function
instead, if its not a buttload of work.

Your program would use the Vista UAC manifest to provide the needed
credentials during program runtime, look it up use Google.

[d-42]

On Jul 28, 8:56*pm, "Mr. Arnold" <MR. Arn...@Arnold.c omwrote:

"d-42" <db.pors...@gma il.comwrote in message

news:d9******** *************** ***********@k36 g2000pri.google groups.com...

Hi,

How do I ask for escalation from within a program?

I'm developing a standalone program that can also act as a 'plugin' to
another application. The way the other app was designed, it scans a
plugin folder in its "program files" folder for settings documents
which contain all the settings it needs to know to call the plug-in
apps.

The problem, of course, is permissions. Under vista, even the
administrator accounts are prevented from writing to the folder
without escalation.

So I how do I request escalation so that my program can save the
settings file to its plugin folder? right now it just throws an
exception 'access denied'. I'd be happy if I could get the 'The
program is trying to access a protected folder..." type of message
that they could just accept. After all, it only normally needs to be
done once.

As it stands now, it works if they launch the software using the 'run
as administrator', but I'd prefer it to ask on that one function
instead, if its not a buttload of work.

Your program would use the Vista UAC manifest to provide the needed
credentials during program runtime, look it up use Google.

But I don't want the entire program need escalation, just the one
rarely used feature. I take it that's not possible? That I have to
spin-off the feature into its own executable, and provide a separate
manifest requiring escalation for that?

-regards,
Dave

[Mr. Arnold]

"d-42" <db********@gma il.comwrote in message
news:3c******** *************** ***********@x29 g2000prd.google groups.com...
On Jul 28, 8:56 pm, "Mr. Arnold" <MR. Arn...@Arnold.c omwrote:

"d-42" <db.pors...@gma il.comwrote in message

news:d9******** *************** ***********@k36 g2000pri.google groups.com...

Hi,

How do I ask for escalation from within a program?

I'm developing a standalone program that can also act as a 'plugin' to
another application. The way the other app was designed, it scans a
plugin folder in its "program files" folder for settings documents
which contain all the settings it needs to know to call the plug-in
apps.

The problem, of course, is permissions. Under vista, even the
administrator accounts are prevented from writing to the folder
without escalation.

So I how do I request escalation so that my program can save the
settings file to its plugin folder? right now it just throws an
exception 'access denied'. I'd be happy if I could get the 'The
program is trying to access a protected folder..." type of message
that they could just accept. After all, it only normally needs to be
done once.

As it stands now, it works if they launch the software using the 'run
as administrator', but I'd prefer it to ask on that one function
instead, if its not a buttload of work.

Your program would use the Vista UAC manifest to provide the needed
credentials during program runtime, look it up use Google.

But I don't want the entire program need escalation, just the one
rarely used feature. I take it that's not possible? That I have to
spin-off the feature into its own executable, and provide a separate
manifest requiring escalation for that?

<http://news.softpedia. com/news/Admin-Approval-Mode-in-Windows-Vista-45312.shtml>

<http://www.computerper formance.co.uk/vista/vista_administr ator_activate.h tm#Summary_of_V ista_Administra tor_-_Super_User_(Hi dden_Account)>

<http://www.codeproject .com/KB/vista-security/MakingAppsUACAw are.aspx>

[Markus Mayer]

How do I ask for escalation from within a program?

>>
Your program would use the Vista UAC manifest to provide the needed
credentials during program runtime, look it up use Google.

But I don't want the entire program need escalation, just the one
rarely used feature. I take it that's not possible? That I have to
spin-off the feature into its own executable, and provide a separate
manifest requiring escalation for that?

Same problem here. I'm trying to write an auto updater that (obviously)
needs to write to the "program files" folder. When I set the manifest's
requestedExecut ionLevel to requireAdminist rator the application can
write there, but with the massive drawback that the user is prompted to
allow the application as soon as it starts.

What I need is that the program only asks for elevation when needed -
that is, if, and only if, it needs to write to "program files".
Any idea how to accomplish that?
(Didn't find any clue in the links provided)

Markus

[Markus Mayer]

Markus Mayer schrieb:

>>>How do I ask for escalation from within a program?
Your program would use the Vista UAC manifest to provide the needed
credentials during program runtime, look it up use Google.

But I don't want the entire program need escalation, just the one
rarely used feature. I take it that's not possible? That I have to
spin-off the feature into its own executable, and provide a separate
manifest requiring escalation for that?

What I need is that the program only asks for elevation when needed -
that is, if, and only if, it needs to write to "program files".
Any idea how to accomplish that?
(Didn't find any clue in the links provided)

Hm. I obviously missed the part saying "This is the only time
applications can do this as applications cannot change their level later
and decide to elevate once running".
Doesn't solve the problem, though. What's the magic of these "shield"
buttons? Do they simply call an executable with a "run as administrator"
constraint?

Markus

[d-42]

On Jul 30, 3:30*am, Markus Mayer
<_nospam_usenet _nospam_@_nospa m_defx_nospam_. dewrote:

Markus Mayer schrieb:

>>How do I ask for escalation from within a program?
Your program would use the Vista UAC manifest to provide the needed
credentials during program runtime, look it up use Google.
But I don't want the entire program need escalation, just the one
rarely used feature. I take it that's not possible? That I have to
spin-off the feature into its own executable, and provide a separate
manifest requiring escalation for that?

What I need is that the program only asks for elevation when needed -
that is, if, and only if, it needs to write to "program files".
Any idea how to accomplish that?
(Didn't find any clue in the links provided)

Hm. I obviously missed the part saying "This is the only time
applications can do this as applications cannot change their level later
and decide to elevate once running".
Doesn't solve the problem, though. What's the magic of these "shield"
buttons? Do they simply call an executable with a "run as administrator"
constraint?

Markus

Based on what I (we have both) read at the codeproject article, it
looks like the process has to be terminated and restarted to get
higher priv's... so I suppose instead of a separate executable, the
menu-item could call the same executable with a 'run as administrator'
and a suitable command line parameter to invoke the feature.

But that's still bloody ugly in my case, since it means the entire
state of the app has to be persisted and restored, to make it
"seamless". For my situation, having it spawn a separate escalated
process to install the plugin file, seems to be the best solution. For
your situation i'd speculate that since you are doing an upgrade, a
terminate and restart as a administrator with command line option to
perform the upgrade is probably acceptable.

cheers,
Dave

[d-42]

On Jul 30, 3:30*am, Markus Mayer
<_nospam_usenet _nospam_@_nospa m_defx_nospam_. dewrote:

Markus Mayer schrieb:

>>How do I ask for escalation from within a program?
Your program would use the Vista UAC manifest to provide the needed
credentials during program runtime, look it up use Google.
But I don't want the entire program need escalation, just the one
rarely used feature. I take it that's not possible? That I have to
spin-off the feature into its own executable, and provide a separate
manifest requiring escalation for that?

What I need is that the program only asks for elevation when needed -
that is, if, and only if, it needs to write to "program files".
Any idea how to accomplish that?
(Didn't find any clue in the links provided)

Hm. I obviously missed the part saying "This is the only time
applications can do this as applications cannot change their level later
and decide to elevate once running".
Doesn't solve the problem, though. What's the magic of these "shield"
buttons? Do they simply call an executable with a "run as administrator"
constraint?

Markus

In follow up I also found this article which is quite informative, and
really, more applicable than the other links we got:

http://www.codeproject.com/KB/vista-...Elevation.aspx

cheers,
Dave

[Mr. Arnold]

"d-42" <db********@gma il.comwrote in message
news:eb******** *************** ***********@k36 g2000pri.google groups.com...
On Jul 30, 3:30 am, Markus Mayer
<_nospam_usenet _nospam_@_nospa m_defx_nospam_. dewrote:

Markus Mayer schrieb:

>>How do I ask for escalation from within a program?
Your program would use the Vista UAC manifest to provide the needed
credentials during program runtime, look it up use Google.
But I don't want the entire program need escalation, just the one
rarely used feature. I take it that's not possible? That I have to
spin-off the feature into its own executable, and provide a separate
manifest requiring escalation for that?

What I need is that the program only asks for elevation when needed -
that is, if, and only if, it needs to write to "program files".
Any idea how to accomplish that?
(Didn't find any clue in the links provided)

Hm. I obviously missed the part saying "This is the only time
applications can do this as applications cannot change their level later
and decide to elevate once running".
Doesn't solve the problem, though. What's the magic of these "shield"
buttons? Do they simply call an executable with a "run as administrator"
constraint?

Markus

In follow up I also found this article which is quite informative, and
really, more applicable than the other links we got:

http://www.codeproject.com/KB/vista-...Elevation.aspx
Why go through all that? It's free.

http://www.tweak-uac.com/what-is-tweak-uac/

[d-42]

On Jul 30, 3:05*pm, "Mr. Arnold" <MR. Arn...@Arnold.c omwrote:

"d-42" <db.pors...@gma il.comwrote in message

Why go through all that? It's free.

http://www.tweak-uac.com/what-is-tweak-uac/

So lets just tell our customers turn off all Vista's security and just
run as administrator? How can you possibly think that to be an
intelligent solution?

Not only will enterprises reject that option, and as a result, reject
our software outright (as they should), but we will perpetuate the
situation that has caused XP to become the malware cesspool it is.

Thanks, but no thanks. I want my software to run within Vista's least
privileged security model, escalate when absolutely needed, and be
accepted by customers and end users.

I look forward to the day when the suggestion to just 'run as
administrator and disable all the security to run our software' is as
laughable on Windows as it is on Linux, OSX, BSD, Solaris, AIX, and
any other respectable OS out there. Its sad that it hasn't reached
that point already.

-cheers,
Dave