UAC behaves differently from one release to the next

[NewsArchive]

Hi All,

I released an update to an application 2½ months ago. Relating to
Windows 7 and UAC, the EXE behaves correctly and as expected when
installed and executed on Windows 7. It runs with no UAC permission request.

I need to release an update now. I used the exact same SB7 script that
was used to compile the previous release to compile the new release. The
only change I made to the script was to increment the version number.

SB code signs the EXE and embeds an "AsInvoker" manifest exactly the
same as it did in the previous install(s).

When I install this update on a Windows 7 OS the icon placed on the
desktop, as well as the icons for the exe and uninstall placed in the
"Start Menu" now have the Windows 7 security shield super imposed over
the icon. When I start the app the typical UAC warning/permission screen
is displayed.

Also something I noticed that probably is a clue. When I uninstall the
previous version it runs as expected with no UAC warning but the new
version uninstall requests UAC permission.

I have verified the exe is code signed, but other than that, I haven't a
clue what to check next once the application is installed. I have
screwed something up and will appreciate *any* ideas/suggestions what to
look for to fix this. This release I am needing to deploy has a major
bug fix in it and I need to get it released as quickly as I can.

Any ideas/suggestions are most welcome.

--
*Regards*,

Lee
www.cya2day.com
CYA - Don't Leave Home Without One

[NewsArchive]

Lee,

The manifest you're embedding in your EXE (which you say is asInvoker) won't
have any bearing to the manifest (and elevation request) for the uninstall
program.

Almost always, your INSTALLER and UNINSTALLER need to be
requireAdministrator. So the UAC prompt for uninstalling is to be expected.

As for your EXE (not your installer) requesting elevation... does this
happen on more than one machine?

Sometimes Windows "remembers" that it thinks some program needs elevation.
What happens if you copy your app (and all its DLLs) from the folder where
your SB installer has installed it into another folder and run it. Does it
request elevation there?

Does your compiler directive to embed the manifest have the Permanent box
ticked? The "Skip if file is already manifested" box?
If so, what happens if you run your EXE from the folder that your installer
is being created from (assuming your development machine has UAC turned on)?
What happens if you re-compile the EXE in clarion (so it's clean with no
existing manifest). Make sure the SB compiler directive is set to
asInvoker, and rebuild the installer?

There's also a free tool you can download that will let you look at the
manifest that's in the EXE you've installed.
http://www.wilsonc.demon.co.uk/d10resourceeditor.htm
If you have a clarionmag subscription, the second of my manifest articles
shows how to use it, but it's pretty straightforward.

Hope these give you some clues.

Jane

[NewsArchive]

Hi Jane,

Thank you so much for your in depth reply. I think I may have found what
some of the problem may be.

Digging into the folder where the app is installed I discovered a
manifest file that is left over from some time ago (years) when I was
manifesting an XP compiled app. For some reason this manifest file was
requesting highest available access.

What I don't understand is why the previous install wasn't behaving the
same way as this new release.

This is exactly what I did:
Early May 2011 I created my version 2.7 release, compiled with
SetupBuilder and installed on Windows 7 Professional 64 Bit for testing
with UAC turned on. Worked as expected. I can uninstall this version,
re-install it and it works correctly even with the incorrect manifest
file in the install folder.

2 1/2 months later (now) I created version 2.8, opened the same exact SB
script that was used in the v2.7 release and changed the version number
to 2.8. Compiled and installed it on the same machine (above) that has
version 2.7 already installed on it. Installed as expected except it now
requests permission.

I'm pretty confident all my settings, both in the app and the
SetupBuilder are correct but suddenly this forgotten manifest file rears
its ugly head. It seems if the OS finds one in the folder it takes
precedent over the embedded one.

I'll play with it some more and see if I can work with what I know now
to get me through.

Thanks a bunch.

*Regards*,

Lee
www.cya2day.com
CYA - Don't Leave Home Without One

[NewsArchive]

Ahh...
Then the UAC behavior would probably "depend". (I say "probably" because
this isn't an aspect I've thoroughly tested.)
If Windows knows that you're a nobody, it wouldn't bother requesting
elevation. It would let the app run, then fail it if it tried to do
something for which you don't have permissions.
If you're logged on with an administrator account, Windows knows that you
have the possibility of elevating so it would ask you and won't run
otherwise.

highestAvailable is a strange one. It could mean anything. Why would you
use it?
One place might be for a backup or restore utility. You might have "backup
operator" privileges on a server, for example - less than administrator but
still higher than a regular user account.
But unless you are creating some kind of "in between" app, there's no reason
ever to mess with a highestAvailable manifest.
Stick with asInvoker for your app unless it really needs admin rights. And
if it does, I prefer to separate the admin stuff into a separate
requireAdministrator app, run the main app asInvoker, and use ShellExecute
to launch the elevated helper app when needed.

If you have previously set a program to run as administrator, BTW, Windows
can remember that: http://www.lindersoft.com/forums/showthread.php?t=30235

BTW... not a week goes by when I don't utter the magic mantra, "I hate
computers!" <g>

jf

[NewsArchive]

Jane.

Removing the pre-existing manifest file seemed to have a positive affect
on the outcome so I am deploying the upgrade.

Once I get over my headache I will dive back into this UAC stuff. I can
only take a little bit at time as it makes my head hurt. It just seems
MS has gone the extra mile attempting to obfuscate everything. I'm a
slow learner but I'll catch up eventually..... :)

Thanks again for your excellent assistance.

*Regards*,

Lee
www.cya2day.com
CYA - Don't Leave Home Without One