We have a line-of-business app written in VB6. When the app starts, it checks a specific network path to see if there any updates to the application. If there are updates, the program logs in as the domain administrator and copies the new files. Since Windows Vista, this is broken because of UAC. In order for our app to update itself, the user has to right click and select "run as administrator". If the user is not a local admin on their computer, windows will ask for administrator credentials. Is their any way in group policy to specify that a particular executable can run as the administrator without prompting? If not, does any one have any suggestions on how to get around this?

  • 1
    I know this won't help, but to be fair..... that app is fundamentally flawed in the way it operates. Is there any chance of an update from the vendor that will fix the real, underlying problem? – Ben Pilbrow Jun 8 '11 at 20:13
  • I know. Unfortunately the underlying problem will not be fixed. We've been living with this problem for a while, but it is a pain to have to come over to the users computer and enter admin credentials – awilinsk Jun 8 '11 at 20:25
  • Ouch. Do you know why admin is required? Is it to access the network share or to replace the files locally? – Ben Pilbrow Jun 8 '11 at 20:27
  • Add files locally. It's installed in Program Files – awilinsk Jun 8 '11 at 20:59

If the app is installed under Program Files and Windows vista/7 UAC will only allow administrators to change those files. There are several possible ways I can see to circumvent this security feature. Be warned - UAC is trying to prevent you from shooting yourself in the foot so be wary.

1) (not tested) reinstall the app in a non-program files directory. Windows is only controlling access to certain special directories

2) turn off UAC. This should return it to pre-Vista function.

3) if the update can be driven from the command-line, schedule a regular task to run as administrator to perform the update

4) Whenever there is a release, package the update and deploy it so that the app never has the need to update.

  • If I turn off UAC, will it allow the program to update even if the user is not a local admin? The scheduled task idea is interesting. Can a scheduled task be deployed through group policy or something like that so we don't have to visit each computer? – awilinsk Jun 8 '11 at 20:52
  • Ah multiple PCs. the complexity raises. 1) If you turn off UAC, I believe you can adjust the permissions on the install directory to allow update. You can use "at /?" to schedule a task from the command-line and group policy can be used to deploy programs. – uSlackr Jun 8 '11 at 20:58
  • If you have a domain controller that is 2008, you can also use GPO to setup task schedules. technet.microsoft.com/en-us/library/cc725745.aspx – Nixphoe Jun 8 '11 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.