How to launch a program as as a normal user from a UAC elevated installer

Question

I'm writing an NSIS installer and the setup program elevates "as administrator" as needed on Windows 7 / vista. I need to run the installed program at the end of the install and don't want to launch it with the same privileges as the installer.

The regular NSIS exec commands run the child process with the same permissions as the installer.

There is a UAC plugin for NSIS, but the documentation on it isn't great and it seems v. new; I'd prefer not to use that plugin.

Ideally, I'm looking for a small .exe I can include that'll launch the target program without UAC elevation. Does this exist?

Any other suggestions?

Thanks!

Hargrave

Answer 1

You only have two options:

• Uncheck and remove the run checkbox (When running on NT6+)
• Use the UAC plugin (It is not that new, but it is a pain to use, so I would suggest you just go for the first option)

There is no external program you can use since it is impossible to get back to the original user from a elevated process (You can try, and get pretty close, but it will not get the correct user in every case)

Unruffled

Option 1 is what we had chosen but this is not "ideal". Has Microsoft made it impossible to run a process "de-elevated"? It seems absurd to not have an API for that. I'm new to NSIS and don't know it too well so I"m not entirely sure how UAC will interact with the MultiUser.nsh script. So, that's another complication I'd like to not deal with. – Hargrave

@KZ: Yes, it's impossible to launch a un-elevated process from an elevated one. The only workaround is to start with an un-elevated process, have it launch your elevated process, and have the elevated process communicate back to the un-elevated one when you want to launch something. That's what the UAC plugin does. I've been using it for many months without problems. – Supercilious

All right then, so back to option 1 and 2. I guess I'll get around to integrating the UAC plugin for a later build. Thanks for the help! – Hargrave

You are saying your own plugin is pain to use? Anyway, I managed to use it successfully so it is possible to use. – Fatty

Hey, and what about CreateProcessAsUserA Win32 function? I tried to use it from Windows Service and it works as charm. However, I try to use it from Windows Installer and it doesn't work (exception code: 0xc06d007e thrown by any executable you try to run that way). Do you know the reason? BTW, it works when I use "Install" option from VS (right click). When run with double click on MSI file - I get the exception. – Hedy

@Hedy Maybe ask about in a MSI related question? I doubt this function throws. Either way, it is impossible to solve something like this in a comment. – Unruffled

@Unruffled You're probably right, however, sometimes, just sometimes, people do impossible things ;) In my practice, I have to do it all the time. But anyway, I agree the problem of throwing from CreateProcessAsUserA is big enough for a separate question. – Hedy

Depending on requirements, there's another option here: launch "explorer.exe path-to-your-app.exe" #1174130 – Alon

@Alon Yes but it is a horrible hack that just happens to work in the current Explorer. – Unruffled

Answer 2

I found the following, which could be wrappered into a a simple command line utility:

http://brandonlive.com/2008/04/27/getting-the-shell-to-run-an-application-for-you-part-2-how/

It only took about an hour to get that code working for my project, and it works flawlessly so far. ;)

Bipinnate

And if the user running the installer (RunAs/Secondary Logon) is not the same as the login user/explorer shell? There simply is no way to go back down that works in all cases! – Unruffled

Why oh why did MS not give a direct method for doing this?! Bizarre! Since this will work in the typical case (end-user running our installer in elevated privileges mode), it'll work for us. But, sigh... – Bipinnate