Force program to run as user with UAC-virtualization


Recommended Posts

Is it possible to force an exe-file to start with User-privileges so everything it tries to do goes into the UAC-Virtualization?

Right now it prompts me for permissions before i can even start it and if i click no it will just quit.

I've created a standard user account, added exe to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\luafv\Parameters\ExcludedExtensionsAdd and disabled Detect application installations and prompt for elevation in gpedit but it still keeps prompting me when i try to start it.

you can open the exe with an resource hacker tool and remove the requestedExecutionLevel Tag from the Manifest. Vista only uses the UAC-virtualization when the manifest is not included or doesn't contain the requestedExecutionLevel Tag.

Thanks for the tip, i downloaded a resource hacker and removed the requestedExecutionLevel from the manifest and the program started without uac-prompt. :)

But the installer had some kind of built in integrity-check so it detected that i had modified the file and shut down itself :(

Is there any way to make UAC ignore the requestedExecutionLevel without modifying the file you want to run?

Actually I'd like to run all programs in virtualization. Many programs(especially installers) ask for elevation even if they don't actually need it. Often they ask in advance only to get permissions to %ProgramFiles% even if i choose to install in another folder later.

I see no reason why an installer should have full access to my computer only to copy itself into a folder.

I've maybe misunderstood how uac-virtualization works but if programs can't touch system-files or other programs, won't it be like a complete sandbox?

EDIT: The program i was referring to above was World of Goo demo. But as i said, i want to virtualize as much as possible, it was just the first program i tried to install after i found out about this feature.

Edited by blehbleh
  • 1 year later...

Hi Blehbleh,

Eventually it IS possible to automatically activate UAC virtualization for any given program, no matter if it has UAC info in its manifest. I was looking for some other information about this and came on this old thread, but since I came here, I guess others may too so I will post how to do here.

So, the simplest method (and the one I use) is certainly to use the registry-based UAC shim. Let's suppose you want the command prompt to always start UAC-virtualized. You will have to add values to one of the following registry keys, the first one being system-wide, the second one per user only :

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags


Then you have to create the following value : C:\Windows\System32\cmd.exe
Type : REG_SZ (i.e. a string value)
Data : RUNASINVOKER

In case this value already exists and is not empty, just append " RUNASINVOKER" at the end of the data (without the quotes, but don't forget the space).

This seems to make UAC consider that the program doesn't have UAC information into its manifest, hence start with UAC virtualization enabled. That can come useful with programs having a manifest with UAC info, but still poorly designed... and don't tell me that doesn't exist...

Here's some more detailed info about setting UAC options.

HTH smile.gif

No need for a complete sandbox here, I think the creator of this topic only wanted UACV to work with a poorly designed app, as it is supposed to work, even when this app says (and lies) "it's OK, I'm UAC-aware, no need to use that with me".

Moreover, I'm not sure a complete sandbox would do the same job i.e. accepting and sandboxing file and registry write failures. Would it not deny access, since "true writes" would fail ? Eventually I don't know, I didn't use any sandboxing tool yet.

  • 4 years later...

Whoops, sorry ! I just came back to this old thread and noticed an error in my post. The registry keys I mentioned are not the correct ones, one should modify those instead :

 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

 

I sincerely apologise to all people who lost time because of my mistake.

 

If only I could edit my post I would, but I see no edit option. Maybe because it's too old...

  On 18/09/2014 at 01:11, NovHak said:

Whoops, sorry ! I just came back to this old thread and noticed an error in my post. The registry keys I mentioned are not the correct ones, one should modify those instead :

 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

 

I sincerely apologise to all people who lost time because of my mistake.

 

If only I could edit my post I would, but I see no edit option. Maybe because it's too old...

 

I modified the previous post with the updated keys. Yeah, the thread is pretty old, but this information is useful for old programs...or new ones under devs who still insist that users should turn off UAC. :P

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Microsoft is removing legacy drivers from Windows Update by Usama Jawad Last month, we learned that Microsoft is making major changes to the development of hardware drivers in Windows. This included the retirement of Windows Metadata and Internet Services (WMIS), along with the process for pre-production driver signing. Now, the Redmond tech firm has informed partners that it will be getting rid of old drivers in Windows Update. In what is being described as a "strategic" move to improve the security posture and compatibility of Windows, Microsoft has announced that it will be performing a cleanup of legacy drivers that are still being delivered through Windows Update. Right now, the first phase only targets drivers that already have modern replacements present in Windows Update. As a part of its cleanup process, Microsoft will expire legacy drivers so that it is not offered to any system. This expiration involves removing audience segments in the Hardware Development Center. Partners can still republish a driver that was deemed as legacy by Microsoft, but the firm may require a justification. Once the Redmond tech giant completes its first phase of this cleanup, it will give partners a six-month grace period to share any concerns. However, if no concerns are brought forward, the drivers will be permanently eradicated from Windows Update. Microsoft has emphasized that this will be a regular activity moving forward and while the current phase only targets legacy drivers with newer replacements, the next phases may expand the scope of this cleanup and remove other drivers too. That said, each time the company takes a step in this direction, it will inform partners so that there is transparency between both parties. Microsoft believes that this move will help improve the security posture of Windows and ensure that an optimized set of drivers is offered to end-users. The firm has asked partners to review their drivers in Hardware Program so that there are no unexpected surprises during this cleanup process.
    • No idea, but I had a client the other week that lost the entire drive to it. I suggested relying on the Samsung T7's instead. The Sandisk Extreme's had reliability issues too.
    • I use it every day so personally yes I need it, or rather I want it. I use OpenShell though, not the garbage modern Start Menu. I just counted and at the moment I have a total of 92 program shortcuts organized into six folders almost exactly the way I did back in Windows 95. I can get to any program I want to run very quickly. I never use Search to find or run programs.
    • I do miss the Apps view from Windows 8.1 Update.
    • I use the search function and little else since Windows 11 (but there are times where Saved Searches take precedence since the search feature on the Start menu is worse than before). I use other features in previous releases.
  • Recent Achievements

    • One Month Later
      gowtham07 earned a badge
      One Month Later
    • Collaborator
      lethalman went up a rank
      Collaborator
    • Week One Done
      Wayne Robinson earned a badge
      Week One Done
    • One Month Later
      Karan Khanna earned a badge
      One Month Later
    • Week One Done
      Karan Khanna earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      665
    2. 2
      ATLien_0
      263
    3. 3
      Michael Scrip
      212
    4. 4
      +FloatingFatMan
      168
    5. 5
      Steven P.
      156
  • Tell a friend

    Love Neowin? Tell a friend!