Hi all,
I've read the WindowsVistaUACDevReqs.doc documentation and I have done
different small tests on Vista to understand the bahaviour and now I
have a few questions.
1) If I create a dummy console application that creates a file in
Program Files directory, this one will succeed and will create the file
b/c of the virtualization.
But, if I do the following call in a console window (a.exe contains just
a printf):
C:>a.exe "C:\Program Files\a.txt"
I get "access denied", probably b/c the a.txt file can't be created in
Program Files.
Why doesn't this one also succeed like the above one?
2) In WindowsVistaUACDevReqs.doc is stated that "Virtualization is only
enabled for the following: [...] 32-bit interactive processes [...]".
How can one define a process being interactive?
3) In WindowsVistaUACDevReqs.doc is stated that on Vista Windows
Explorer will show to the user the "global view" of a directory which
means when browsing to Program Files the user will see besides the real
content of Program Files dir, also what's in virtualized forlder
(%LOCALAPPDATA%\VirtualStore). I have a Windows Vista default
installation, and I do NOT see with Windows Explorer the virtualized
files when browsing for instance in Program Files, only the real content
of Program Files folder. Why is that?
4) Nowhere is written that now it's better to use ShelExecute() instead
of CreateProcesss(), but along the doc it's mentioned only
ShellExecute(), so I assume now, for Vista, using ShellExecute() is
somehow a requirement. I did some tests, and indeed if process1 with a
manifest "asInvoker" launches using CreateProcess() process2 with a
manifest "requireAdministrator", the CreateProcess() call fails with
ERROR_ELEVATION_REQUIRED.
So, am I correct when I'm saying that for compatibility with Vista one
should always use ShellExecute() _or_ ShellExecuteEx() when launching
another process?
5) In MSDNL and on codeguru is written for ShellExecuteEx() that it
returns a handle to the new created process but this is not guaranteed:
"'ShellExecuteEx()' provides only a handle to the process but
unfortunately it is not guaranteed and is depending on several options
you can set within the 'SHELLEXECUTEINFO' structure."
I have an myapp.exe that launches different other applications and then
myapp.exe has to babysit these launched applications, so I need to be
sure that ShellExecuteEx() will always return a handle and this one is
"trustable". Can I be sure about that?
6) My tests show that the right-click in Windows Explorer -"Run as
administrator" always overwrites the exe's manifest. Is this correct?
(for instance if the exe has "highestAvailable" and the current user is
a dummy user, still the exe will run as administrator)
7) On
http://technet2.microsoft.com/Window....mspx?mfr=true
is written: "Note:Windows Vista protects %systemroot% files and folders
with permissions designed for Windows Resource Protection (WRP), which
can only be accessed by the System service. Administrators can read
system files and folders but cannot write to them. Note that this
differs from previous versions of Windows."
Later in the same article is written what an Administrator can do and
it's "Copy or move files into the Program Files or Windows directory".
So then which one is it? As my tests show the second statement is
correct, meaning an admin can write and delete files from
Windows\system32 directory for instance.
8) An application that runs as standard user can't normally write
something in let's say "C:\Program Files\MyApp" directory. But if I use
cacls.exe to change the rights for this directory, then the application
will be able to write in the directory. Is that corect?
9) Is there any way to detect if the current user is part of the
administrator group? I mean, I have for instance a mother-app with
"asInvoker" that runs an app that is applying a patch, so that apply-app
needs admin rights and let's say the current user doesn't know the
credentials so the user dismisses the application. At this point I don't
want my mother-app to bother any user anymore, unless he is an admin
that only needs to consent for the app to run. So, in my mother-app I
want to check if the current user is from admin group and only if he is
to run the apply-app. Can smth like this be done?
10) On http://channel9.msdn.com/Showpost.aspx?postid=209647 is said:
"you could shut-down your original application and restarted with
elevation". How can you do that? Once you have a manifest for that exe
you can't change it on runtime right?
11) How can I add to the YES button of a MessageBox a
Vista-requireAdmin-shield? For instance "Would you like to do those
settings now?" YES/NO. If user presses YES a new app is launched that
needs elevation. This is why I would put the shield on the YES button of
the MsgBox dialog. How can I do that?
12) In WindowsVistaUACDevReqs.doc is written: "Add a Shield Icon to a
Task Dialog Button
Caution
A task dialog button should never require a UAC shield icon"
What is a "Task Dialog Button"?
13) In WindowsVistaUACDevReqs.doc is written:
"Virtualization Reference
File virtualization
[...]
Excluded binary executables: .exe, .dll, .sys"
What does this mean? that those files are excluded? Aren't they
virtualized? If not, what happens with them?
Sorry for the long post.
Thank you in advance,
Viv
