Launching app after installation without admin priviliges

[JoderCoder]

The article at this link - http://www.flexerasoftware.com/webdocuments/PDF/launch.pdf - explains how to launch the app after installation. Since my installer requires admin privileges and run with UAC token on Vista, application is also launched with the admin privileges as well as they are inherited from the installation process.

I would like to run the application without UAC permissions as just standard user. How can I achieve this?

Thanks.

[JoderCoder]

Just re-posting the question again. Since the installer is run with a high (perhaps the highest) level Integrity Level, I believe the application is launched with the same level of integrity which is causing a problem when it is not desired to launch an app with a high Integrity Level.

Does anyone have any idea on how to get around this?

Thanks.

[gprasadholla]

I dont think you have an option to lower the level. Execution levels defined are asInvoker, highestAvailable, requireAdministrator. None of these serve your purpose.

But, what is the problem you are facing while running as administrator?

[Holger_G]

I recommend to run the MSI execute sequence with elevated privileges only and Setup.exe with the 'asInvoker' level. Normally the UI sequence of a MSI installation does not need elevated privilges (recommended).

[JoderCoder]

Thanks for the responses.

Holger_G,

How would you make sure Execute Sequence is run with elevated privileges? Is there a setting you can make sure every action in Execute Sequence is elevated? I know windows installer would prompt for UAC depending on the heuristic approach to detect the elevation requirement. But I have a custom action which is right after AppSearch that requires elevation but it will fail if I was to leave it to MSI to prompt the UAC.

gprasadholla,

My application is talking to another application via COM. COM wouldnt allow this communication if 2 applications are running with different Integrity Levels.

Please keep your suggestions coming guys..

Thanks.

[JoderCoder]

Found this: http://msdn.microsoft.com/en-us/library/bb625960.aspx

I might have to write a custom action to do it using CreateProcessAsUser().

[JoderCoder]

I think I came to a conclusion on this. I will write a custom action using CreateProcessWithTokenW(). Anybody faces this issue can visit this:

http://www.codeproject.com/KB/vista-security/createprocessexplorerleve.aspx?display=Print

To InstallShield team,

I think InstallShield may want to re-visit the custom action shown in http://www.flexerasoftware.com/webdocuments/PDF/launch.pdf (written by Robert Dickau).

Thanks to everyone involved.

[Holger_G]

JoderCoder wrote:

How would you make sure Execute Sequence is run with elevated privileges? Is there a setting you can make sure every action in Execute Sequence is elevated?

Just set 'Require Administrative Privileges' at the Summary Information Stream settings to Yes (default setting for a Basic MSI project). Your custom action should be a Deferred Execution in System Context. There´s a white paper available that gives some tips about running CAs on Vista or later.

You should also note that your setup may not work properly in silent mode (where the UI sequence will be skipped) if you perform special actions during the UI sequence.

JoderCoder wrote:

My application is talking to another application via COM. COM wouldnt allow this communication if 2 applications are running with different Integrity Levels.

If possible move that communication to the execute sequence.

[JoderCoder]

Holger_G wrote:
Your custom action should be a Deferred Execution in System Context. .

What about the CAs that cannot be deferred?