Vista User Account Control Elevation

[glenharvy]

Hi everybody

In IA7 R2 & under Application Requirements there is a tick box down the bottom of the page that says "Vista User Account Control Elevation".

I am unable to find anywhere in the help file or knowledgebase or this forum as to what ticking this box actually does.

I would like to think it handles the intricacies of having my .Net2 project run without problem when run under Vista with the UAC turned on.

Can anyone tell me what ticking the box is supposed to do.

BTW: Ticking the box results in a message during installation under WinXP that 'This product requires at least User Account Elevation' which when clicking OK promptly closes the installation.


Thank you.

[MichaelNesmith]

It mandates the presence of UAC technology on the target system. It will fail unless Vista or higher is used and UAC is turned on. You can customize this default behavior in MSIcode, of course.

As for what you really need, you want the de-elevate check box in the Run Program As window. That is what will run your program in the original invoker context after setup itself has been elevated.

[glenharvy]

Thanks for that info Michael.

Vista UAC is starting to make some sense to me at long last.

My Vista users are all having problems accessing the $ALLAPPDATA$ folder when they have the UAC turned on. Using IA's Access Control, I have set this folder for Everyone have read/write permissions however this obviously is not applied in Vista.

Do you have a White Paper on this or can you recommend some web site that has some useful information on this that is easy for a novice to follow?

[MichaelNesmith]

You need elevation to read that folder. When you apply the attribute, it does not extend automatically to any children of the object.

[glenharvy]

Thanks for your prompt response.

I've spent several hours researching this issue and it is obviously one that is/has caused quite an amount of grief for many people.

Just to confirm, in IA 7 I have configured 'Set Access Control' for $ALLAPPDATA$\\Aquarius Communications\\MyCourts\\Resources\\*.* for everybody to have read/write access and it is applied after the install. In Vista however, this has no affect at all. Vista Users need elevated privileges to access that folder.

This is not practical as far as I can tell as my program accesses a SQLCE database located in that directory.

Can you suggest how I get my application to work under Vista UAC. Do you recommend I use another directory altogether for the data directory?

[MichaelNesmith]

Are you elevating your setup under Vista?

[glenharvy]

Are you elevating your setup under Vista?

My reading of various web sites is that any program named 'setup.exe' is automatically elevated. Nevertheless, I presume IA7 can overwrite that because of the option I found and hence I have, on IA's Summary Information page chosen 'Elevate Administrators Only (highest Available).

I assume therefor that IA is running with Administrator privileges. Frankly it must be to do everything it has to do.

I have also discovered that when my program is run from the IA installation it inherits IA's permission level; my program runs with no problems.

I have read elsewhere in this forum that the 'Set Access Control' must be included in MSICode BEFORE Apply Install otherwise files and folders will not inherit the levels set in 'Set Access Control'. This makes sense however why IA doesn't put it there in the first place bewilders me.

I have also read that I need to create the folder to be shared prior to Apply Install as well as 'Set Access Control' and there is a recommendation that I use an IA plug-in to do that. After viewing the plug-in's screen I can assure you I have no idea how to complete it and I am unable to locate assistance either in your help file, web pages or google to enable me to.

Everyone tells me just to disable the UAC but that is not a solution that I care to countenance. Nor is it very professional of me to have to tell my prospective clients that my program is NOT truly Vista aware.

This is not an isolated problem - there are many examples both in these forums and the net generally where developers are having similar problems.

Is there any chance at all of getting a definitive 'white paper' on the subject or perhaps a blog post.

Thank you for your help so far - I do believe I am getting there.

[Steve]

Hi Andy,
I know that you are not a fan of 'nudging', however I think that this post really needs a definitive response from InstallAware. UAC is a topic of confusion and frustration for many folks and some additional instruction would be appreciated by all.

Just to summarise the highpoints of the above converstation, that need clarification:
Michael stated:

As for what you really need, you want the de-elevate check box in the Run Program As window. That is what will run your program in the original invoker context after setup itself has been elevated.

Following this and other comments by Michael's in this thread seems to indicate that we should not being using the "Vista User Account Control Elevation" checkbox and that instead we should be using the "de-elevate check box in the 'Run Program As' window"...

Huh?
What does he mean by this? Does he mean don't use the 'Vista User Account Control Elevation' checkbox and only use the 'de-elevate check box in the 'Run Program As' window...
or...
does he mean we should always use the 'Vista User Account Control Elevation' checkbox in conjuction with the 'de-elevate check box in the 'Run Program As' window?

Having said this, what program exactly are you supposed to be "running" with the 'de-elevate check box in the 'Run Program As' window?
I ask this because 'glenharvys' issue was that he could not get full permissions on certain of his installation folders. I don't follow how using the 'Run Program As' function will resolve this issue.

Could you please elaborate and clarify this for me?

Thanks in advance Andy!

Best regards,
Steve

[blackchristiandate]

I'm new here, just browsing for some good and informative stuff and posts..