cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
JoderCoder
Level 8

Launching app after installation without admin priviliges

The article at this link - http://www.flexerasoftware.com/webdocuments/PDF/launch.pdf - explains how to launch the app after installation. Since my installer requires admin privileges and run with UAC token on Vista, application is also launched with the admin privileges as well as they are inherited from the installation process.

I would like to run the application without UAC permissions as just standard user. How can I achieve this?

Thanks.
Labels (1)
0 Kudos
(8) Replies
JoderCoder
Level 8

Just re-posting the question again. Since the installer is run with a high (perhaps the highest) level Integrity Level, I believe the application is launched with the same level of integrity which is causing a problem when it is not desired to launch an app with a high Integrity Level.

Does anyone have any idea on how to get around this?

Thanks.
0 Kudos
gprasadholla
Level 4

I dont think you have an option to lower the level. Execution levels defined are asInvoker, highestAvailable, requireAdministrator. None of these serve your purpose.

But, what is the problem you are facing while running as administrator?
0 Kudos
Holger_G
Level 10

I recommend to run the MSI execute sequence with elevated privileges only and Setup.exe with the 'asInvoker' level. Normally the UI sequence of a MSI installation does not need elevated privilges (recommended).
0 Kudos
JoderCoder
Level 8

Thanks for the responses.

Holger_G,

How would you make sure Execute Sequence is run with elevated privileges? Is there a setting you can make sure every action in Execute Sequence is elevated? I know windows installer would prompt for UAC depending on the heuristic approach to detect the elevation requirement. But I have a custom action which is right after AppSearch that requires elevation but it will fail if I was to leave it to MSI to prompt the UAC.

gprasadholla,

My application is talking to another application via COM. COM wouldnt allow this communication if 2 applications are running with different Integrity Levels.

Please keep your suggestions coming guys..

Thanks.
0 Kudos
JoderCoder
Level 8

Found this: http://msdn.microsoft.com/en-us/library/bb625960.aspx

I might have to write a custom action to do it using CreateProcessAsUser().
0 Kudos
JoderCoder
Level 8

I think I came to a conclusion on this. I will write a custom action using CreateProcessWithTokenW(). Anybody faces this issue can visit this:

http://www.codeproject.com/KB/vista-security/createprocessexplorerleve.aspx?display=Print

To InstallShield team,

I think InstallShield may want to re-visit the custom action shown in http://www.flexerasoftware.com/webdocuments/PDF/launch.pdf (written by Robert Dickau).

Thanks to everyone involved.
0 Kudos
Holger_G
Level 10

JoderCoder wrote:

How would you make sure Execute Sequence is run with elevated privileges? Is there a setting you can make sure every action in Execute Sequence is elevated?


Just set 'Require Administrative Privileges' at the Summary Information Stream settings to Yes (default setting for a Basic MSI project). Your custom action should be a Deferred Execution in System Context. There´s a white paper available that gives some tips about running CAs on Vista or later.

You should also note that your setup may not work properly in silent mode (where the UI sequence will be skipped) if you perform special actions during the UI sequence.

JoderCoder wrote:

My application is talking to another application via COM. COM wouldnt allow this communication if 2 applications are running with different Integrity Levels.

If possible move that communication to the execute sequence.
0 Kudos
JoderCoder
Level 8

Holger_G wrote:
Your custom action should be a Deferred Execution in System Context. .


What about the CAs that cannot be deferred?
0 Kudos