How to launch an executable on the end of installation with proper rights?

Question

I'm launching my Windows application this way after the installation completes:

!define MUI_FINISHPAGE_RUN_FUNCTION "LaunchApplication"

...

Function LaunchApplication
    ExecShell "" "$INSTDIR\Application.exe"
FunctionEnd

But this has a strange and undesired side-effect. Apparently is my application launched with admin rights.

I cannot drag & drop any data between a web browser (tested with Firefox and IE) and my application.

If I quit my application (the session started from NSIS), and restart it from the start menu icon everything works! - I can drag & drop to the browsers without problems.

So I suspect since in the beginning of installation there is a UAC request, somehow UAC rights are transferred to the process I'm launching after installation. Since the browsers run in a low security process Windows refuses to exhange any data with them (in the process instance that is launched with NSIS).

How to launch an exe from NSIS, so that this UAC/security problem does not happen?

Crepe

You are correct to note that elevated processes will automatically launch other processes elevated. This behavior has existed (and annoyed users) since UAC was introduced in Vista. The system blocks data transfers between non-elevated and elevated apps unless certain registry keys are set. – Saraband

I would suggest modifying the title of the question to clarify the problem. Something along: "How to launch an executable on the end of installation with proper rights? – Cernuous

Answer 1

Use Exec '"$WINDIR\explorer.exe" "$TEMP\MyUnElevatedProcess.exe"'

Taken from http://mdb-blog.blogspot.com/2013/01/nsis-lunch-program-as-user-from-uac.html

Selfimmolation

thanks. it looks like a step in the right direction. unfortunately I must pass a command line parameter to my application, and this seems not possible if I use the explorer.exe trick, unless I create a batch file beforehand. – Crepe

The answer from lnordeide shows a way to pass arguments to the process you want to execute. – Scrumptious

Answer 2

I recommend using the plugin ShellExecAsUser as mentioned by Anders. I use it for this exact same purpose like this:

!define MUI_FINISHPAGE_RUN_FUNCTION LaunchApplication

...

Function LaunchApplication
   SetOutPath $INSTDIR
   ShellExecAsUser::ShellExecAsUser "" "$INSTDIR\Application.exe" ""
FunctionEnd

Note the use of SetOutPath to ensure that Application.exe starts with installation folder as it's current directory. ShellExecAsUser does not set this.

Fab

This seems to sometimes give errors on Windows 10 Windows cannot find 'C'. See github.com/mherrmann/fbs/issues/255. – Megalopolis

Answer 3

Try This:

!define MUI_FINISHPAGE_RUN "$INSTDIR\Application.exe"
!insertmacro MUI_PAGE_FINISH

OR

Function .oninstsuccess   
Exec "$INSTDIR\Application.exe"   
FunctionEnd

Somatology

Answer 4

The UAC plugin can be used to get around this issue but it is a bit hard to use. You could also try ShellExecAsUser but I would recommend that you just don't use the run checkbox at all...

Stamford

it looks like the UAC plugin isn't available anymore! I use it in my script to do the elevation in the first place. An idea my be to try to un-elevate in .oninstsuccess, but I have no idea how to do it, and since the plugin's webpage is gone (apparently highjacked) I don't know how to un-elevate. – Crepe

Someone messed with the wiki, fixed now. And you can always access older revisions of the wiki page if it happens in the future... – Stamford

thanks for the restoration! I've downloaded the latest version (mine is over 2 years old), but the Unicode version is missing!? (which I'm using). Also, to my other question - is there away to un-elevate (go back to user level) in .oninstsuccess using your UAC plugin? – Crepe