How To: Tell Vista's UAC What Privelege Level Your App Requires

Windows Vista's UAC feature is designed to minimize security risks by running most applications under a standard user token, lessening the risk that an attacker could gain admin rights to the machine.  UAC allows executables to specify what privelege level they require -- if an app doesn't provide a specification, it will be run in the context of a standard user, but UAC will provide some virtualization features to make it appear as though certain admin tasks succeeded.

Ian Griffiths presents another screencast that covers the default virtualization behavior, and then shows how to write a UAC manifest to specify a desired privelege level, for both native win32 apps and managed .NET apps.

Be sure to also check out the UAC team's blog, as well as How To: Use Vista's UAC Feature To Avoid Always Requiring Admin Rights.

Here's an example of a manifest:

<?xml version="1.0" encoding="utf-8"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>