I didnt get correct answer and got lots of answers like "we can not do like this" for my previous questions.
Thats why I decided to explain in detail about my problem please help me if you can or please ask your friend who can answer this.
Now my problem:
Step 1:
I created a C# program which edits various windows registries.
For editing windows registries we must have an Admin privilege.
My program is running fine in Administrator mode without any problem.
Step 2:
I want my program to be run into limited user mode also. If few people didnt get what I am saying here is that I want to run my above C# code into Guest mode.
In guest mode there is a restriction that We can not change Windows Registries.
So as I am executing my Application, I am getting one notification which is asking for Admin Password.
After inserting Admin Password my application is working fine.
Step 3:
I want that my application must not ask Admin password every time in Guest/limited account.
I also want that in Guest mode my Application should work.
I also want that in Guest mode my Application should be able to access and change Windows Registries.
Step 4:
Lot of people replied me that we can not do this in Guest mode since Windows is restricting users to edit windows registries for security purpose. So please if you also feel like this then please do not reply to this question.
I am answering to those people that, all good antivirus which run into Guest mode has access to Windows Registries.
Step 5:
Since I know Admin Password so is there any way of saving Admin password in our C# code and bypass popup message of asking Admin password again and again.
Is there any way that we will instruct Windows that our application will be running in Admin mode and do not ask for Admin password again and again
How Antivirus application running in Guest mode do all the operation like deleting virus from system32 folder and resetting registries after Virus attack. These antivirus application never asks for "We found a virus in System32 folder, Since I am running in Guest mode and unable to delete virus, so please enter Admin password so that I can delete virus"
I hope you understood what i mean to ask?
I want to develop a C# application which should run in any mode (Admin/Guest/Limited) and should be able to Create, Edit and Delete Windows Registries.
Note: Please do not answer this with "right click and Run As Administrator".
To the best of my knowledge, antivirus software solves this problem by running two (or more) processes: a user interface program running as the guest user, and a privileged process (usually a Windows service). The user program is not able to actually manipulate privilege-restricted resources (like secure registry hives) -- instead, it communicates with the privileged process (hopefully in some secure way) and the privileged process performs the privileged action on behalf of the user.
This is the same kind of technique by which programs ever access privileged resources, such as hardware. Your user-level process doesn't (usually) have the right to perform various hardware actions, like remapping memory in the MMU, but the OS does, and you can get the OS to do what you want by asking it to. System calls thunk into kernel mode, which is fully privileged. However, the system call interface limits the kinds of privileged actions which you can take.
I cant help but saying, NO, you cant do admin things under a guest account. And no- you cant programmatically bypass UAC.
Maybe the following 2 workarounds are interresting for you?
I believe antivirus software runs under the System account (can only be installed by an administrator). For your application, you can create a server/client architecture (both running no the same machine) where the server is installed by the administrator (as part of the whole package) and runs by default under the System account. Then you can use the client on the quest account to send commands to the server.
One other solution might be not to use the registry directly but use another underlying datastore which is accessible by a guest account and synchronize that on demand with the registry (startup and shutdown?), so you only need the admin to login once or twice during the run of your app.
Related
I've been wrestling with this issue for a few days and can't find any posts that solve it for me. Maybe what I want isn't possible.
We have developed a WinForms application for internal use at our company.
Most employees do not have admin access in windows.
Our application requires admin access to the machine and needs to automatically start when the user logs on.
Here's what I've tried:
1) Putting a Shortcut in the Startup folder
I can get the app to automatically launch (using a relauncher), but it still requires an admin to be at the computer on every restart (to enter the password).
2) Registry Key
I created a Software\Microsoft\Windows\CurrentVersion\Run registry key to automatically start the application. Whether I run the relauncher or the app itself, UAC demands a password on every restart (or relogin).
3) Scheduled Task
I created a scheduled task to automatically start the app on logon using admin permissions on the machine (under use the following account). I also checked the 'Run with highest privileges' box. UAC still pops up on every restart.
4) Windows Service
I tried to run the app as a windows service, but it has a user interface (which is disabled by windows services).
5) Disable UAC for Specific Program
It looks like you can disable UAC for a specific program but that involves downloading the Application Compatibility Toolkit, creating some kind of database, etc. I'd very much prefer that our IT staff wouldn't have to do that at every machine. At this point, it's probably my only option.
It seems like an admin should be able to install an application so that it runs automatically without a prompt. Am I missing a way to do this?
You should make split your program into a non-admin UI, which runs on user startup, and an admin service, which performs the administrative tasks.
To run admin-requiring code from the UI, use WCF to ask the service to do it.
Beware that hostile parties may impersonate the UI and ask the service to do malicious things; you need to carefully figure out what the service should be able to do in response to IPC calls.
Your problem is not a UAC problem, it is a security problem.
And the answer depends on what your application that "requires admin rights" needs to do.
If your application needs to be able to start, and stop services, then the User needs the ability to start and stop services. In which case you need to give the users that privilege.
If the user's need the ability to alter or delete files, then they need that privilege too. In that case it is easier to grant Full Control permissions to Everyone.
If your application needs the ability to modify registry keys in the HKLM tree then you can, again, grant Full Control to Everyone in the registry.
If you need your users to have the ability to modify items, then they need permissions to modify those locations. Granting them those NTFS permissions is not a bad thing; it is exactly what those permissions exist for - to control access.
But why
But then we ask why? What is it you're doing that users need all the rights of an administrator, and all capabilities of an administrator, all the power of an administrator, but you don't want to make them a member of the Administrator's group?
The answer is almost invariably that your internal use application doesn't need to run as an administrator.
What Would XP Do?
The question becomes:
What would you do on Windows XP?
A standard user on Windows XP didn't even have the UAC convenience feature. If a user wanted to run an application an administrator: they had to logout and login as an administrator. How did, or how would, the application work on a system with UAC disabled?
Presumably very little of your application needs to run as admin - the rest would be better running as the unprivileged user. This is very common (think self-updating browsers, for example).
The proper way to do this is to install a service to do the privileged bit, and have the UI communicate with the service.
Our application requires admin access to the machine ...
Why?
You cannot bypass the UAC prompt, and this is by design.
See FAQ: Why can’t I bypass the UAC prompt? for a good discussion of why. Excerpt:
If it were possible to mark an application to run with silently-elevated privileges, what would become of all those apps out there with LUA bugs? Answer: they'd all be marked to silently elevate. How would future software for Windows be written? Answer: To silently elevate. Nobody would actually fix their apps, and end-user applications will continue to require and run with full administrative permissions unnecessarily.
I am working on my year 3 Project at Uni.
An integral part of the feature is that only an admin can mess with the program this includes:
Install
Uninstall
Settings (Files)
and Finally, the controversial; 'Shutting down the program'.
Here is what I currently have in mind.
Windows Form App, Launches at startup, takes note of all kinds of things, and monitors and prevents others, shuts down with the PC (not sure how to make the program exit nicely on shutdown? )and then should the computer be turned on again the program is there at startup, doing its job.
I am not sure if its better for a windows service, but the program definitely needs a windows form interface so users can login (should an admin require to do so, through a user account).
Could anyone counsel me on whether a windows service would be better, if so, some good documentation on them? I looked and tried out the MSDN tutorial but without much luck or even understanding.
I know it's bad practice to interfere with the user, and prevent them from closing a program, but its all part of a functionality that an admin would knowingly install.
O yea, I forgot to mention the program would be installed.
normally this is done with user permissioning and roles.. you create users and assign them roles. if a given user who is trying to "close" is having "admin" role then we allow him otherwise we dont. you can put these users in registry and create a windows service that your program can talk to or directly query.
We are about to roll out several hundred new machines running windows 7, with the OS installed via WDS so at the moment we can make changes and sysprep them into the build.
The problem is a .Net app we wrote years ago which itself spawns a modified command shell. That shell runs a dataflex application that itself needs to run with elevated permissions.
We don't grant users any general admin rights.
Is there a mechanism where we can pre-allow our .Net app to run as administrator so that the command control runs as Administrator?
I'm aware of the changes I can make in the app.manifest to require that the program runs as Administrator. I'm not aware of how I can (as an Administrator) configure the machine to allow that to happen without giving the user more rights or credentials than I would want them to have.
Does the application have to run as Administrator, or does it just need access to specific things? If it has a spurious "am I admin" check at startup, you can probably use a shim from the Application Compatibility Toolkit to lie to it, and then configure access permissions to the things that it actually needs.
If that looks like it'll fly, then you'd be better off taking further questions over to serverfault.
What Roger is getting at is that many people assume that if an app doesn't work as a normal user, they have to give it Administrator rights.That's not true in many, if not most cases. You have to find out WHAT specific rights it's failing with, and then assign those rights. This is more work, but it avoids giving general administrator rights to people.
My application needs to run with administrator privileges because of some specific phone components.
I've build an executable that does nothing else than calling the real application with the specific local administrator account (username and password).
I use the ProcessStartInfo and Process class for this purpose.
The problem: Some word interop is being done and the required word templates are stored on a unc share.
Local admin -> no domain/network context -> no access to shares.
Are there any other solutions than these two:
put a domain account into the administrator group on the affected machines and call the app. with this user
put the word templates onto the local drive
Maybe there are some uac elevation experts out there?
I think the best way would be to temporarily switch back to the "real" domain user context, but I don't know how this should work without providing his credentials...
Thanks for reading - and maybe feedback!
Having that small application, which knows the administrator password is a security nightmare. Have you tried opening the .exe for your small app in notepad? I'm fairly sure that the password will be there - in plaintext for anyone to read.
It is far better to solve this by giving the user running the app the required privileges. Full administrator access is very seldom required. Have you tried looking into exactly what the phone app needs? Sysinternal's Process Monitor is often very good to use.
In Windows just because your account is in the Administrators group doesn't mean it is privileged enough to be able to delete some system files. Is there a way to perform actions with this 'supreme' admin power in C# without having to login to Administrator account(Only using an account in the Administrators group).
EDIT
In my case it is a personal application (I'm sorry I didn't specify this) and I trust myself to not delete any system files or give any rogue virus access to this privilege. I am using a domain account on a personal computer and while I have got Administrator on my personal computer I don't want to keep switching between users. What I want is a simple way of running my program as the highest possible privileged user. Is there no way whatsoever unless logged in as a full Administrator?
Question Answered thanks. I have been informed that there is no possible way of launching an application with FULL administrator rights as you can in Linux with the sudo command. Adding a UAC manifest was helpful though as it specified how to implement rights into my app(http://msdn.microsoft.com/en-us/library/bb756929.aspx).
//closed