Can I run RegAsm without being Administrator?

Question

My coworker is trying to register some COM components (which I wrote) via RegAsm.exe and it says he needs Administrator privileges. His account has admin privileges but he is not logged in as Administrator. Is there a way to use his regular user account and succeed at this task?

Mancunian

Answer 1

Admin privileges are required to allow Regasm.exe to update the registry. If this is a UAC restriction then create a shortcut on the desktop for cmd.exe and check the "Run this program as an administrator" checkbox. Or change this setting on the Visual Studio Command Prompt shortcut, that's easier.

Furring

Answer 2

I work in an environment/jurisdiction where giving local admin access to all users is simply not possible (legal/compliance/regulations will not allow).

It appears there is no equivalent of this function in .NET world: AtlSetPerUserRegistration

Try this: Using regasm, generate the registry entries with /regfile argument. By default, registry entries should use HKEY_CLASSES_ROOT (HKCR) as a root. Modify the entries (manually, or by script) to use HKEY_CURRENT_USER (HKCU).

Finally, distribute your .NET DLL with the registry script. You can still run regedit without admin rights to register your .NET DLL. Manually from the command line, using a batch file, or a (tiny) separate installation program can handle the registration.

Biocatalyst

Answer 3

I think this question belongs elsewhere, but Windows uses least privilege so if he is a user that is both a normal user and an Administrator than he gets normal user privileges. Use runas to make this work or right click the item and "run as administrator"

Metathesize

Answer 4

Why don't you use registration free com? Its only been supported since 2003 and obviates the need for UAC / administrative access to install COM components.

With RegFree COM you can just bundle the COM dlls with the application that uses them as a private assembly - but that doesn't mean they can't be properly installed - either in the registry or in WinSxS by the final deployment install.exe/msi

---

Subtext wrt the actual query: no - COM registration is in the HKEY_LOCAL_MACHINE key that always requires administrative access.

---

I lied: Actually you can. If you create a application with no manifest at all, Windows deduces that its an XP era application that expects administrative access to run and will activate a compatibility mode that, amongst other features, redirects write access to HKLM to a writable location under HKCU. So the COM component registration "succeeds" - but is registered for the current user only.

Im not sure why the ability to register for just the current account isn't supported generally outside the compatibility framework.

Gnni

Answer 5

Check this out: https://gist.github.com/florentbr/6be960752fc852ee99eece6b4acb8ba7 I was trying to do the same thing and was about to give up when I came upon it.

It's a cmd script that will register the SeleniumBasic.dll in the registry without having admin privileges. With a bit of work you should be able to repurpose the code to register your COM components.

Many, many thanks to Florent Breheret for SeleniumBasic and this cmd script to register it!

Configuration

I'm far removed from that task, but hopefully it helps somebody else. – Mancunian

Answer 6

I am logged into an account that has Administrator privileges. But RegAsm.exe still says it needs Administrator privileges.

[From some notes I have for Windows 2008 R2. Confirm on other Windows operating systems that support UAC. The following assumes that you are permitted to make changes to the Local Security Policy. ]

In its default configuration, User Account Control (UAC) settings give the local Administrator full privileges, but restrict the privileges of other members of the Administrators group. To lift the UAC restrictions on other members of the Administrators group, do the following:

1. Select Start -> All Programs -> Administrative Tools -> Local Security Policy.
2. Select Local Policies -> Security Options.
3. In the right panel, double-click the third entry from the bottom which reads User Account Control: Run all administrators in Admin Approval Mode.
4. Click Disabled.
5. Click OK to close the dialog and close the Local Security Policy configuration tool.
6. Reboot the computer to complete this change to the UAC settings.

Baxie