Currently i'm busy creating an application for an Siemens IPC. No problems with the application itself, but some difficulties with elevating the application to "Administator"
We need to have administrator rights to set PC date time, and we use a manifest to elevate the application to administrator.
No problems so far :)
But my problem lies in the fact the "normal" use is an operator which has limited access on the UAC, so i need to provide my administrator credentials to succesfully elevate the application.
I need this to happen automatically at startup, but the windows system does not allow me to use a startup schedular task of windows to run the program with the correct credentials.
Is there any other way to achive to run the application with administrator rights, without having to fill in the UAC credentials?
Thanks in advance!
Related
I have a service application that supports both start as service and interactive mode. The service I register is executed as the NetworkService user; the interactive mode is running as a computer administrator (normal users have no access to the program).
Now, some resources (e.g. files) are only available to the user NetworkService. Can I somehow tell the program to run the code as NetworkService, even if started by an administrator?
Now, some resources (e.g. files) are only available to the user NetworkService. Can I somehow tell the program to run the code as NetworkService, even if started by an administrator?
NetworkService is a low privilege account. Administrator is a high privilege one. Having a situation where files are available to NS but not do admin is somewhat unusual. While is true that an admin has the right to impersonate most accounts (WindowsIdentity.Impersonate(), see Hans link for NS impersonate issues), I would revisit the situation and make sure this is actually necessary. It is much more likely that the files in question can, and should, be ACL-ed differently so that both NS and Local Administrators have access to the file.
Also consider splitting the application into a service component, always running as service, and a UI component that the administrator can invoke. Have the UI communicate with the service over some protocol, eg. via LRPC or shared memory of even HTTP.
In general you can change permission for file if you have Administrator rights.
Or start code as NetworkService account with help PsExec.exe like described here
So the problem here is that I'm using ClickOnce to create an internal application that co-workers can install once and I can push updates by publishing. The problem is that ClickOnce doesn't jive with my need for administrator privileges; it won't publish if I have that requirement declared in the app.manifest. The reason that I have that in there is that I need to be able to edit the host file which is in system32/drivers/etc. Most other threads I've read say that the most I can do is run asInvoker so that the app can inherit all of the permissions that I have as a principal user on the domain, but I found this to be a bit inaccurate. You see, my user has permissions to edit the host file, but my principal does not possess the administrator role. So my question is this...
How can my ClickOnce app request/gain permission to edit the host file? As an aside -- the applicaiton will also be doing some minor registry editing. Alternative approaches are welcome.
As jvanrhyn alludes, the official policy is that ClickOnce applications cannot request administrative elevation if User Account Control (UAC) is enabled (as it is by default on Vista and later). Like you've discovered, if the manifest file sets the requestedExecutionLevel attribute to requireAdministrator, the application will fail to install and run.
This is a security precaution. The whole purpose of UAC is to minimize the risk of applications making unauthorized changes to system settings, which could compromise system integrity. The whole point of ClickOnce is to make deployment of applications fast and easy. Clearly these are two contradictory goals.
Again, the official stance is that if your applications requires administrative privileges, you should be deploying it using Windows Installer or some similar utility.
However, since as far as I understand your question you only need to have administrative privileges on first install, there might be a workaround where you can continue to use ClickOnce for deployment. You would keep the application's requestedExecutionLevel at asInvoker so that it would run under normal circumstances with standard (unelevated) privileges and would work with ClickOnce. But you would also have a secondary application that did require elevation. Your primary application would then launch this secondary application on demand (e.g., on first run), causing the secondary application's privilege demands to kick in, and thus prompt the user for elevation. That second application would run elevated, make the changes that it needed to make, and then quit. The primary application would continue to run un-elevated, and could be launched thereafter without requiring administrative privileges.
This is keeping with the spirit of the security precautions, since it minimizes the need for applications to run with administrative privileges. You can include the secondary "helper" application as a delivered resource in the ClickOnce application, and it can then be launched from the ClickOnce private storage area.
I have a simple Windows Service running on my computer. I want to start/stop it from inside a Windows application named ServiceManager. I already can do that when I run the ServiceManager with admin privileges. Is it possible to do the same thing without the admin privileges?
Maybe changing some permissions in the service. If it is possible, how can I do that?
By the way I am programming in C# language.
I have an app of mine that I need to distribute to 5000 computers on my business domain via SCCM and i'm having problems with the windows security. The point is that my app requires administrative rights to access to registry keys and launch some "specific" featues on the local system and all the users on the domain (except for the IT support team of course) doesn't have such privileges.
I was wondering that I could make windows call a launcher on startup next, this launcher would get admin username and password on the app's server and then run the app with those credentials. But i'm having difficulties performing this task once i'm new on C# (i'm a java programer) and i haven't found any way of using the runas command with both username and password information.
Other point, it would be perfect if i could make use the admin privileges without the anoying windows UAC prompts.
Can anybody help me?
I'm not sure about what I'm going to say, but just did a bit of research that may help you.
You can try to schedule a task to run your program, and config this schedule to run it with admin rights, at startup.
Scheduling a task
Then the only thing left you need to look for is how to program easily this task for all your computers.
Hope this helps you
If your application must be run as an administrator in order to operate correctly: then tell Windows that:
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
So that if i'm a standard user (i.e. not an Administrator), and i try to use your program: i will be prompted to get an administrator to come to my desk and enter their credentials so i can run your program.
The downside of your program only functioning with admin privileges is that a standard user cannot run your program.
And you could try turning off UAC; but that doesn't fix anything. UAC is a quality-of-life feature.
if i turn off UAC
i'm still a standard user
except now i have to logout and login as an administrator
The correct solution is to let your program work as a standard user.
We have just discovered that code that calls the Win32 SetDateTime function needs to run in elevated mode in Windows 7, i.e. even when logged in as an administrator, one still has to choose to run the Set Date code as Administrator for the call to change the date.
Is there anything I can do in code to always call this function under elevated privileges?
You can use the ShellExecute API call to launch an executable with elevated privileges.
However, if UAC (user access control) is enabled on the machine, the user will still get the UAC prompt asking for permissions to run elevated.
So I don't think you can avoid the prompt for elevation permission, but at least your user doesn't have to manually run the program as an admin.
Please let me know if you need help in how to launch an executable as an admin.
This is just not how security works. Changing the clock is a very intrusive operation, it has a very large number of side effects. There is no mechanism in Windows, or any other operating system for that matter, where you could start a process with limited privileges and then just arbitrarily bypass these limitations and suddenly gain administrator rights. There wouldn't be any point whatsoever to running programs with limited privileges if that was possible.
If you want to do something like this then you'll have to run your program with elevated rights. On Vista and Win7 that requires you to run as a service or a scheduled task. Which require an administrator to get installed. UAC provides a way gain admin rights for regular programs, you have to include a manifest in your program so the user is notified about your privilege elevation. Google 'requireadministrator', take the first hit.
Like others have said, you need to spawn a new process to get elevated permissions, which will result in a UAC dialog.
If this is something you need to run unattended you could try running as a service. That would give you the elevated context you need.