Vista, UAC, RSA encryption, Fonts

[JeffTucker]

We use RSA encryption to keep our connection strings secret in various config files for our application. Recently we discovered that installing under Vista with UAC on by an administer resulted in a seemingly correct installation. The setting in the IA setup is UAC elevation to the highest level in Vista.

However, if that same administrator logs out, and logs in, he gets an RSA container cannot be found when he runs the program. If the admin then turns off UAC and logs out/in he gets a particular font is not available, but we just installed it. Installing that font again lets the user run successfully. It is as if UAC being on let the user install and run within a "login session" and no more.

If UAC is not on, then installation and running of the program is just fine.
The program to setup RSA encryption on each config file is just a plain Run Program instruction.

This same installation technique was utilized under Vista with an NSIS installation package and worked just fine (UAC on off - did not matter).

We require the installing user to be the admin of the machine.
Do you have any advice on what to set UAC settings in IA so that the program will work with UAC on or off?

[MichaelNesmith]

Sure! Use Run Program As and click the de-elevate check-box.

[JeffTucker]

Would this be the same as changing the Summary Information -> Vista UAC Elevation to "Never Elevate (asInvoker)" for all the Run Program instructions?

[MichaelNesmith]

Nope. Press F1 and find out more about the differences in the online help.

[JeffTucker]

We want to prevent non-admins from running even under Vista. The problem is that UAC being on is actually interfering with installing.

I did try running the setup as Never Elevate (asInvoker) and again the RSA container cannot be found when UAC is on in Vista. However, if we turn it off and retry the app, it works ok.

I'm confused why using the Run Program As with deElevation when the admin is running setup would have any effect whatsoever here.
So far tried: Never Elevate (asInvoker)
Elevate Administrators only (highestAvailable)

Neither work.
All I have left to try is Always Elevate (requireAdministrator)

[JeffTucker]

Can I Run Program As with the System account? I need to run some encryption of config files and give rights to all to those files.

instead of this:
Run Program under UAC $WINDIR$\\Microsoft.NET\\Framework\\v2.0.50727\\aspnet_regiis.exe -pa "DataProtectionConfigurationProviderKeys" "NT Authority\\Authenticated Users" (WAIT)

like this:
Run Program as User \\System: $WINDIR$\\Microsoft.NET\\Framework\\v2.0.50727\\aspnet_regiis.exe -pa "DataProtectionConfigurationProviderKeys" "NT Authority\\Authenticated Users" (WAIT)