UAC, Elevated Privileges and setup files

[RobertKozak]

I created an empty project and built it in Vista. The setup icon has a shield and when I try to run it the UAC prompts.

I didn't select that I required Administrator privileges so I was expecting that I wouldn't be prompted. Especially since the setup files is completely empty. There is no script and it is doing nothing.

I am guessing that you are automatically adding the manifest and that the requestedExecutionLevel is being set to requireAdministrator. Can this be an option dependant on the Administrator Privileges setting you have in the Project options?

-- Robert

[CandiceJones]

Actually, the priv is highestavailable. So, running as a user (non-admin) does not require credentials or the UAC prompt.

The MSIcode script is separate from the project level settings which could be used to potentially customize the value in the manifest, but the existing implementation is already elegant.

[Immelman]

I also have a problemwith the UAC in vista.

When I run my setup.exe as an administrator on vista my application installes fine. But when I run my setup.msi that I created with the Group Policy Wizard I get the UAC prompt as expected but, after I click Allow nothing seems to happen.

I am running IA version 6.24 SP4 and compiling the exe, as well as creating the MSI via Group Policy manager, on an XP SP2 machine.

Now according to this Article: http://www.macrovision.com/company/news/newsletter/tips/is_vista.shtml

This is why it might not work:

Setup works when using setup.exe but fails when directly launching the .msi file

Symptom: When you launch your setup by double clicking the .msi file or running msiexec it fails, but if you launch it using setup.exe your setup succeeds.

Cause: Windows Vista detects that setup.exe is an install program that will probably require elevated rights, and therefore displays the UAC prompt. As a result, the UI sequence will run with elevated privileges. However, if you launch the .msi file directly the UAC prompt will happen later, when your setup switches from the UI sequence to the Execute sequence. In this case the UI sequence runs with restricted permissions.

Solution: Custom actions that modify the target system (and therefore need elevated rights) should be scheduled as deferred in the system context and placed in the Execute sequence between InstallInitialize and InstallFinalize. Modifying the system in the UI sequence has never been good practice. Often, this was used to run child installs without using the deprecated "nested install" actions. The "InstallShield MSDE 2000 Object for NT Systems" is an example of this, and it will fail on Windows Vista.

Yet I emplore none of this functionality. What could I be doing wrong?

[CandiceJones]

The Group Policy file is meant for use only with Group Policy deployment. It is not meant for use on *any* operating system outside of Group Policy deployment.