Ray
Fri Jul 25 19:45:37 CDT 2008
Here's a reasonable tutorial on how to add a manifest to your app:
http://www.professionalvisualstudio.com/blog/2007/10/05/enabling-your-application-for-uac-on-vista/
In terms of having an app that both admin and non-admin users can do
stuff with, I haven't don't much in that line, however, my understanding
is that apps are either running with an admin token or not, and there
isn't a way to "add one" later. That may have changed since the last
time I looked.
One way to do this is, as you say, to split out the "admin-requiring"
stuff into a separate exe that is manifested to "requireAdministrator".
There's some more information here:
http://codefromthe70s.org/vistatutorial.asp
It confirms that you have to run an exe separately to have admin privs,
however, you can use CreateProcess to run an app with admin rights, so
you could theoretically keep it all in 1 (un-manifested) exe and re-run
it if you need to elevate.
Mai Kee Reiss wrote:
> Hi Ray,
>
> again you say someting like "just manifest your application to require
> xxx privileges". There must be some background, I have completely missed
> the last years!
> How Do I? What Tools do I need to use?
>
>> Fundamentally, the right thing to do is check for the privilege you need
>> in order to do whatever it is that you want to do.
>
> I really hoped, you'll say this, because it fits in the picture I have
> in mind ;-)
>
>> If you want to install a driver, check for the driver install privilege
>> [....] Administrators don't necessarily have to have all the privileges
>> enabled [....]
>
> I hoped, you'll also say this...
>
> Okay. Let me tell, how I understand things and then please correct me,
> where I'm wrong, yes?
>
> In the past I wrote programs only for both admins and users. Programs,
> which where able to say at some point:
> "Sorry, insuficient rights! Please cry for your admin" - for instance
> when called with commandline param "-U uninstall service" or such. Or,
> when not beeing admin, or not having write access to HKLM, some parts of
> the menues have been disabled. I'm shure you can imagine that kind of
> tools I talk about.
>
> If I understand you right, I have to split this up now into /two/ .exe
> files, one with an "user Manifest" (and without the "-U" option or boss
> menues) and one with an "Admin Manifest" (and with all that dangerous
> options inside).
> Right?
> And what is a manifest and how can I create one and how can I attach it
> to the app?
>
> :-?
> Mai Kee
>
>
>> Mai Kee Reiss wrote:
>>> Hi there,
>>>
>>> I found a couple of APIs to ask Win32 if the current user belongs to
>>> administrators group. But most of them looking very confusing and
>>> complicated. Others seem to only work in different networking
>>> infrastructure, as domains or such. Found:
>>>
>>> NetUserGetInfo() + NetGroupGetUsers()
>>> GetSecurityInfo()
>>> PrivilegeCheck()
>>> LsaOpenPolicy() + LookupAccountName()/LsaLookupNames() +
>>> LsaEnumerateAccountsWithUserRight()
>>> AccessCheck()
>>>
>>> very confusing!
>>>
>>> I wonder if there is a "Best Current Practice" to see if the current
>>> user is "admin" or "normal user". Something simple which only returns a
>>> BOOL value for that check.
>>>
>>> Any hints?
>>>
>>
>>
>
--
Ray