Limited User account problems on Vista Business

[Anthony Wieser]

I'm currently running version 6.4, and when I run InstallAware, it gives me the following error at startup.

Cannot create file "C:\\Program Files\\InstallAware\\InstallAware 6\\mruf.txt"

Is this a known bug, and is there a patch or workaround?

Anthony Wieser
Wieser Sofware Ltd

[Anthony Wieser]

I can't imagine why it requires admin rights to create an installer. Installing the software, I can understand, but not to run the IDE.

Does anyone else have issues with this. If so, maybe we can get this fixed in a new release.

Anthony Wieser
Wieser Software Ltd

[Anthony Wieser]

Instead of running as an admin, it appears that it's possible to run in a limited user account, if you give the program files\\install aware folder on your system full rights to the user account.

If you're running a home version you can do this with cacls, otherwise, simply use the security tab after choosing properties of the folder.

Anthony Wieser
Wieser Software Ltd

[neillans]

At present the IDE requires administrative privileges.

This is not something that we plan to change in the immediate time line, however as one of the other posters has already been said - you can work around this by granting full read / write access to the installation directory.

Personally, this does not give me any sleepless nights; I have other programs that still require Admin rights under Vista, and some of them are even more worrying (i.e they are not development tools!).

Don't forget; even Visual Studio still needs Admin rights ...

[Anthony Wieser]

While Visual Studio may require admin rights for some functionality on Vista, strangely, it's working for me without at the moment.

Here's what concerns me about admin rights:

Say someone creates a sample setup, that somehow finds a security vulnerability on the program. Because it's running as an admin now, my system is 0wn3d when the buffer overrun, or whatever other exploit is utilised and control transfers to the hacked code.

Running as a limited user account mitigates this.

Anthony Wieser
Wieser Software Ltd

[neillans]

This is true, however, the same could be said for the bootstrap that is used on the actual installs (this runs as an elevated user), as well as bootstraps on ANY installers you run.

[Anthony Wieser]

You've lost me I'm afraid. Are you saying that the bootstrap programs run as an admin without even requesting elevation from the user, and somehow just manage to get elevated credentials without my say so?

Anthony Wieser
Wieser Software Ltd

[neillans]

They run as elevated rights, however, you *should* be prompted.

If not, there is something non-standard about your Vista configuration!

As for normal installations on Windows XP etc, these have their own elevation mechanism that is provided by MSI, so yes, parts of the install will be running with elevated rights with no (or minimal) prompts.

[ggreig]

I'm evaluating InstallAware at the moment, and this issue is really giving me pause. We develop as limited user as a matter of course and there are few better indicators that yell "shoddy software" than tools that don't play ball.

I've not quite written InstallAware off yet, but I have to say that failure to run as a limited user is one of the reasons we're looking to switch from another supplier, so you're not getting off on a good footing here.

Please get it sorted. There's really no excuse, especially if the workaround you recommend is just changing file permissions.

[MichaelNesmith]

For the record, even Visual Studio requires admin rights.

[ggreig]

For the record, even Visual Studio requires admin rights.

That doesn't in any way justify InstallAware's limitations, and it's not completely accurate anyway. Some functionality of Visual Studio requires admin rights, but it's perfectly possible to use the program for every-day development as a limited user if you don't need those specific functionalities. I've been doing so since before the release of VS2005, on Windows XP, XP x64, and now Vista x64. If I do need admin rights for something, I can always choose to run a program as admin temporarily just for that purpose.

InstallAware, by way of contrast, can't even create a new project file without admin rights, because it attempts to write to a file in its Program Files directory. You can't tell me that an installation authoring package shouldn't know about special system folders and how to use them!

If installation authoring software plainly isn't a good Windows citizen itself, why on earth should I trust it to make a good job of authoring my installs? I expect installation authoring packages to be exemplars of good behaviour in this area.

Let's make this criticism constructive: I suggest you refer to Aaron Margosis' "Non-Admin" Weblog, an excellent resource for developing as a non-admin which will hopefully help to improve InstallAware's quality as a product.[/url]

[Gizm0]

No, you're wrong. The "some functionallity" you say, is DEBUGGING in most cases, which is why you USE an IDE at about 80%. You can write code at notepad and compile it otherwise.

So Visual Studio needs admin rights no matter what. There is only a new beta patch that corrects that by doing some tricks with elevation of privileges when starting a process through VS and making VS the original owner, (so it can attach itself) than running as a current user. Someting like IIS does with ASP default user.

[ggreig]

I beg your pardon; you're partially right, and I was wrong to be quite so vehement. To develop without admin privileges, you do have to be a member of the Debugger Users local security group, as well as Users, but that is far from being the same as being a member of Administrators. My apologies for forgetting that detail.

Here's a slightly dated MSDN article (http://msdn2.microsoft.com/en-us/librar ... S.71).aspx) on how to develop as a non-Admin which contains the relevant details.