==========================================
I noticed that if a program is running as UAC elevated (admin or high user privileges),
any opening process by this process will get the same privileges as the executing program,
which means, that any process opened by this UAC elevated program will be elevated also.
I found a solution for it, for opening the process UN-ELEVATED from ELEVATED running program.
I show this information as for NSIS installer, but can be used in ANY development environment (C#, NSIS, C++, JAVA, VB, and any).
The idea is to run the process in UN-ELEVATED mode, using windows's file explorer process `explorer.exe` (info).
Lets say the process that we want to launch is on `$TEMP\MyUnElevatedProcess.exe`.
So, for NSIS code, I will just write:
And this will do the work...
The process `MyUnElevatedProcess.exe` will run with same ELEVATION that have your windows login, as have `$WINDIR\explorer.exe`.
Execute with parameters:
In addition, if the UN-ELEVATED process need to executed with parameters, you will need to create another file that executes the UN-ELEVATED process (for example a BATCH file which just run the process with the command line parameters).
a good example can be:
Remember,
if your main program (the executing), is not ELEVATED, this logic is not relevant, because then you can just run `Exec` (open-process function in NSIS) which will have the same elevation as your process.
I hope it helps,
MDB-BLOG
I show this information as for NSIS installer, but can be used in ANY development environment (C#, NSIS, C++, JAVA, VB, and any).
The idea is to run the process in UN-ELEVATED mode, using windows's file explorer process `explorer.exe` (info).
Lets say the process that we want to launch is on `$TEMP\MyUnElevatedProcess.exe`.
So, for NSIS code, I will just write:
Exec '"$WINDIR\explorer.exe" "$TEMP\MyUnElevatedProcess.exe"'
And this will do the work...
The process `MyUnElevatedProcess.exe` will run with same ELEVATION that have your windows login, as have `$WINDIR\explorer.exe`.
Execute with parameters:
In addition, if the UN-ELEVATED process need to executed with parameters, you will need to create another file that executes the UN-ELEVATED process (for example a BATCH file which just run the process with the command line parameters).
a good example can be:
; assuming that the file `MyUnElevatedProcess.exe` exists on `$TEMP\` ; create shortcut with ARGUMENTS CreateShortCut "$TEMP\Shortcut.lnk" "$TEMP\MyUnElevatedProcess.exe" "/arg1 /arg2 /arg3" ; execute the file NON elevated Exec '"$WINDIR\explorer.exe" "$TEMP\Shortcut.lnk"'
Remember,
if your main program (the executing), is not ELEVATED, this logic is not relevant, because then you can just run `Exec` (open-process function in NSIS) which will have the same elevation as your process.
I hope it helps,
MDB-BLOG
It works. Thank you very, very much.
ReplyDeleteThis is a fantastic technique that many were unaware of. Thanks for sharing it! One caveat though: If you run "Explorer.exe YourApp.exe" on Windows XP, there will be two Authenticode security prompts shown before the application loads.
ReplyDeleteUnfortunately, the Windows Shell team has replied that the current behavior of "Explorer.exe AppName.exe" is a bug and may not work in future updates/versions of Windows. Applications should not rely upon it.
ReplyDeletesos un genio
ReplyDelete+1
ReplyDeleteAny chance to get this working together with the MUI_FINISHPAGE_RUN macro?
ReplyDeleteTo answer my own question:
Delete!define MUI_FINISHPAGE_RUN "$WINDIR\explorer.exe"
!define MUI_FINISHPAGE_RUN_PARAMETERS "$TEMP\MyUnElevatedProcess.exe"
worked for me.
To embedd your parameters inside quotes (if they contain blanks), use the
Delete$\"
like:
!define MUI_FINISHPAGE_RUN_PARAMETERS '$\"$TEMP\MyUnElevatedProcess.exe$\"'
This solution worked for me too but it changes working directory. How to prevent that?
DeleteOr use MUI_FINISHPAGE_RUN_FUNCTION, e.g. see http://nsis.sourceforge.net/Run_an_application_shortcut_after_an_install
ReplyDeleteMy brother suggested I might like this website. He was totally right. This post truly made my day. You can not imagine simply how much time I had spent for this information! Thanks!
ReplyDeleteWOW just what I was looking for. Came here by searching for %keyword%
ReplyDeleteWhen some one searches for his necessary thing, thus he/she needs to be available that in detail, so that thing is maintained over here.
ReplyDelete