Nice catch -- bad repro steps on my part. Ironically enough, I'm very familiar with the SKU differentiation around secpol.msc -- I just ended up being careless there, since all of my office machines are currently running business SKUs
For those who are looking to modify the policies with RegEdit, the following values map to the policies I mentioned earlier:
0 -- elevate without prompting
1 -- prompt for credentials to elevate
2 -- prompt for consent to elevate (default)
0 -- prompt on user desktop
1 -- prompt on secure desktop (default)evildictaitor
Thanks for the heads-up on the Gadget download experience. I'll look into it and make sure the right folks are on it.Wodei
The times you've needed to run an MSI from an elevated CMD window are actually bugs in the MSIs themselves. Essentially, each MSI action can be marked as running as the user (i.e., non-elevated) or as the machine (i.e., elevated). Over the course of Vista,
we saw quite a few MSIs that had per-machine custom actions mismarked as per-user -- we shimmed them (via MSI transforms, which get installed to %WinDir%\AppPatch\msimain.sdb as part of the OS shim infrastructure), but some obviously managed to fall through
the cracks. If you can point me at the problematic MSIs, I can make sure the ISV knows what needs to be done (and potentially get them shimmed for SP1).
Note that not all MSIs require elevation, since MSI packages can be marked as entirely per-user. I expect to see much more of this moving forward (e.g., it would be ideal for a game demo or "try and buy" software).
For WinRAR, version 3.7 should be fully Vista-compliant, including elevation only when necessary (e.g., unpacking to an admin-only folder, vs. your user profile) and fixing the issue with the context menu handler. The Visual Studio team, similarly, has their
elevation behavior at the top of their list right now.
In theory, the shield should automatically be appearing on any EXE that's marked to require elevation -- any inconsistency there, like you said, makes the marking nearly valueless. I'll see if we can repro that on-site with the VS and WinRAR settings you described.