Comment Feed for Channel 9 - How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights http://ecn.channel9.msdn.com/o9/previewImages/100/204975_100x75.jpg Channel 9 - How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights Windows Vista's UAC feature is designed to minimize security risks by running most applications under a standard user token, lessening the risk that an attacker could gain admin rights to the machine.  This is a great step forward for users, but it may leave developers wondering what to do when their apps do really need admin rights to complete a task.Ian Griffiths to the rescue, with another screencast showing how to structure an app to enable certain admin tasks to run in an elevated context.Be sure to also check out the UAC team's blog. en Sun, 19 May 2013 08:45:39 GMT Sun, 19 May 2013 08:45:39 GMT Rev9 Re: How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights here.  It boils down to this:

Elevation:Administrator!new:{guid}

posted by jmazner

]]> http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632872111400000000 Thu, 29 Jun 2006 20:52:20 GMT http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632872111400000000 jmazner Re: How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights
HKCR
{
  NoRemove CLSID
 {
  ForceRemove {8E29BED3-2E02-49DC-A9B7-3A5984BCD95F} = s 'CanElevateWork Class'
  {
   ProgID = s 'CanElevate.CanElevateWork.1'
   VersionIndependentProgID = s 'CanElevate.CanElevateWork'
   ForceRemove 'Programmable'
   InprocServer32 = s '%MODULE%'
   {
    val ThreadingModel = s 'Apartment'
   }
   val AppID = s '%APPID%'
   'TypeLib' = s '{25CA48AF-1D18-4A9F-9749-7354C41CDCEC}'
   Elevation
   {
       val Enabled = d 1
   }
   val LocalizedString = s '@%MODULE%,-101'
  }
 }
}


HKCR
{
 NoRemove AppID
 {
  '%APPID%' = s 'CanElevate'
  {
      val DllSurrogate = s ''
  }
  'CanElevate.DLL'
  {
   val AppID = s '%APPID%'
  }
 }
}

posted by jmazner

]]> http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632872113820000000 Thu, 29 Jun 2006 20:56:22 GMT http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632872113820000000 jmazner Re: How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights
Can we have your sample codes for reference?

Thanks,
Larry

posted by larry_lai

]]> http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632899349270000000 Mon, 31 Jul 2006 09:28:47 GMT http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632899349270000000 larry_lai Re: How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights
 I know you can try things like OpenInputDesktop(0,FALSE,0) and watch for failure to know if the secure desktop is up, but that's the opposite, that's _failing_ to get the desktop, not capturing images of it..

posted by djmitchella

]]> http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632899849790000000 Mon, 31 Jul 2006 23:22:59 GMT http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632899849790000000 djmitchella Re: How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights          I'm having a really tough time trying to implement the elevated COM method under VB.NET. I'm not an API guru, but need to be able to migrate some of my VB.NET utils for my company to use UAC.

I've managed to create my own custom control which implements the Shield icon via a SendMessage API call, but the actual UAC part, I'm really stuck on.

I've segmented out my Admin functions into COM classes, but am having a lot of difficulty figuring out how to use CoCreateAdminAsInstance through VB.NET.

There doesn't seem to be any sample code available for VB.NET so any help in explaining this to me, or assisting in any way would be greatly appreciated!

Thanks in advance, Dan.

posted by sintaxasn

]]> http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632954727470000000 Tue, 03 Oct 2006 11:45:47 GMT http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632954727470000000 sintaxasn Re: How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights The computer may restart when you add a manifest that has the Windows Vista extension to an .exe file or to a .dll file in Windows XP Service Pack 2 (SP2)

http://support.microsoft.com/Default.aspx?kbid=921337


Resolution 
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=463884&SiteID=1

posted by eak

]]> http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632998920770000000 Thu, 23 Nov 2006 15:21:17 GMT http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c632998920770000000 eak Re: How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights
http://robgarrett.com/cs/blogs/software/archive/2007/02/12/net-wrapper-for-com-elevation.aspx

Encapsulates all the hard stuff for non-C++ and non-COM developers.

posted by robgarrett

]]> http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c633075819360000000 Tue, 20 Feb 2007 15:25:36 GMT http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c633075819360000000 robgarrett Re: How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights Hi jmazner,

Could I have your sample codes for reference?

Thank you,

Vincent Kao

posted by VincentKao

]]> http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c633118763210000000 Wed, 11 Apr 2007 08:18:41 GMT http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c633118763210000000 VincentKao Re: How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights
That is an excellent video.  Your help is very much appreciated.  I noticed you have a video showing how to include the manifest with managed applications...

When I launch a "requireAdministrator" .NET app, it gives the ugly "Allow/Cancel" prompt instead of the nice "Continue/Cancel" prompt -- the consent prompt.  But when I sign the file with an authenticode signature, it uses the consent prompt.  However, I don't know how to specify the application name like you do in this COM elevation demo.  Basically what I'm asking is how do you set the application / assembly name in a Managed app.  I've tried the <assemblyIdentity> element in the uac.manifest, but it seems to have no effect.  Any help?  Thanks.

posted by SugarDaddy

]]> http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c633149410010000000 Wed, 16 May 2007 19:36:41 GMT http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c633149410010000000 SugarDaddy Re: How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights
   Can I have your sample code for reference ?
 
Jesper Lin

posted by Jesp

]]> http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c633240585920000000 Thu, 30 Aug 2007 08:16:32 GMT http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c633240585920000000 Jesp Re: How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights "I'm wondering how you made that recording? The video has footage of the UAC desktop -- isn't that meant to be secure and inaccessible to normal applications like screen grabbers -- did you point a camera at your monitor,"

A bit late to be replying, but better late than never I suppose...

The video capture was done by a 2nd PC with a video capture card whose input was wired into the VGA output of my laptop.

So it was slightly higher tech than pointing a camera at the laptop, but it sort of has the same effect: it lets you grab exactly what's on screen, without falling foul of internal security barriers in the machine.


Ian Griffiths

posted by IanG

]]> http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c633464660300000000 Thu, 15 May 2008 16:33:50 GMT http://channel9.msdn.com/Blogs/jmazner/How-To-Use-Vistas-UAC-Feature-To-Avoid-Always-Requiring-Admin-Rights#c633464660300000000 IanG