1

I am trying to make an application run on any user sign in (or session connection, be it local or remote) having elevated privileges, but without UAC prompt. When new user is added, application should run on his sign ins as well, without additional setup.

I have setup Hyper-V machine with Windows 10 Enterprise v.1709 for testing purposes. On it I have main (referenced as "Admin") account, which is in Administrators group, and one (referenced as "User") account which is only in Users group.

I have created simple WPF application which shows current user and whether it has admin privileges. Final application will be WPF as well.

I will be using WiX to create installer for my application suite (aforementioned application, windows service, maybe something more). The behavior from the title must be set automatically during installation. On installation I can do whatever I want, being limited only by WiX capabilities, but it allows me to run custom application (C#) during setup, so I think there are no restrictions. Installation will be run from account with admin privileges.

Below is what I have tried and what was the outcome:

App in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

  • "Run this program as an Administrator" not checked

    Admin: Starts, no admin privileges

    User: Starts, no admin privileges

  • "Run this program as an Administrator" checked for all users

    Admin: Does not start

    User: Does not start

Entry in HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  • "Run this program as an Administrator" not checked

    Admin: Starts, no admin privileges

    User: Starts, no admin privileges

  • "Run this program as an Administrator" checked for all users

    Admin: Does not start

    User: Does not start

Task Scheduler, trigger "At log on of any user"

  • No other options

    Admin: Does not start

    User: Does not start

  • "Run with highest privileges" checked

    Admin: Starts, admin privileges

    User: Does not start

  • "Run this program as an Administrator" checked for all users

    Admin: Does not start

    User: Does not start

  • "Run this program as an Administrator" checked for all users, "Run with highest privileges" checked

    Admin: Starts, admin privileges

    User: Does not start

How can it be done? Event Viewer seems to not log any specific information when application does not run at all. Should it be there or such logs might be placed somewhere else? Where then?

Target: Windows 8+, Server 2012+

Improve this question
  • What does your app do that it needs admin rights and needs to run in the context of the user with admin rights? – longneck Oct 18 '18 at 17:27
  • 1. Application must see current user identity as it sends some data with user's login. 2. Application must access and be able to modify registry under HKLM; Second restriction was made so the overall architecture would be simpler - no WCF or any other communication on the machine. The other way would be to have registry per user (HKCU), but some settings are to be shared. Is there elegant way to do this? Shared db-like file, maybe sqlite? Having such solution would remove admin privileges constraint and the application could work as normal user app. – Mars Oct 19 '18 at 12:36
  • See my edited answer. – longneck Oct 19 '18 at 13:03
3

If you must have a GUI, then the correct way to handle this is to have a GUI app and a separate system service. The service does the actual work, and the GUI just passes commands to it. Impersonation can be used to allow the service to act as the user.

If the only reason you need admin access is to write to an HKLM key, then admin access is the wrong way to do this. In your installer, create the registry key and change the ACL on the key so that Users have Write access. No admin rights needed to run the app that way.

Improve this answer
  • Thanks! After some fight with ACL, I managed to access registry without admin privileges :) – Mars Oct 22 '18 at 10:40
  • This doesn't really solve the initial question – Bluscream 4 hours ago
  • @Bluscream The simple answer is it's not possible. And then I gave functionally equivalent solutions. How does this not solve the initial question? – longneck 1 hour ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.