Force running a program as non-administrator in Vista

I've just installed, on Vista 32-bit, a program which in my opinion shouldn't require administrator rights. It's not installed in a system directory, and its purpose shouldn't obviously require any special privileges. However, the .exe has a UAC shield on it, and it asks me to elevate privileges immediately upon execution.

I'm prepared to risk it doing nasty things with the privileges of my user account, but not prepared to risk elevating it. Is there anything I can do short of setting up a virtual machine for it (or downloading the source and compiling it myself)?

(FWIW, the program in question is Pencil - pencil.evolus.vn/en-US/Downloads/Application.aspx - but I'm more interested in general answers than app-specific ones).

Peter Taylor

Posted 2011-01-13T11:39:58.537

Reputation: 213

You might wish to see this question and this question, both of which are similar (but subtly different) and might be helpful to you.

– DMA57361 – 2011-01-13T11:46:41.547

Answers

Take from an answer to a similar question:

For all apps with requestedPrivilegeLevel="highestLevel" in their manifest, you can use Microsoft's Application Compatibility Toolkit to shim the application with the RunAsInvoker fix, which forces the app to run with your standard user tokens.

For more information on how to use the Application Compatibility Toolkit ...(snip)... general instructions.

DMA57361

Posted 2011-01-13T11:39:58.537

Reputation: 17 581

The general instructions you link seem to say that this is actually doing the opposite: elevating without the UAC prompt. – Peter Taylor – 2011-01-13T12:10:42.800

@Peter, not quite (I had the links the wrong way round so you may have been on the wrong page, sorry about that, make sure you are looking here ), Figure E is setting the program to run "asInvoker" (ie, as the user calling the program, without elevation).

– DMA57361 – 2011-01-13T12:13:22.703

That's the one. It says "The RunAsInvoker option will allow the application to run with the same privileges and user rights as those of the parent process, which in this case is the Compatibility Administrator that you launched using the Run As Administrator command. Your application will run with full Administrator privileges." – Peter Taylor – 2011-01-13T12:16:48.460

@Peter - nuts, I think you're right. I'm sure I've done this before to un-elevate an executable... Unfortunatly I'm at work right now so can't verify. I wonder if one of the options or parameters contains something that needs tweaking (ie, to change the "invoker" to be the user, not the toolkit), I'll have to check this evening when I'm home... – DMA57361 – 2011-01-13T12:23:13.277

@Peter - see this Microsoft article and the quote This fix specifies that the application does not require elevation. This is getting a little bit ambiguous between the sources, but I think it may well work. It also suggests trying SpecificNonInstaller to prevent Windows guessing that it is an installer and elevating because of that.

– DMA57361 – 2011-01-13T12:34:20.830

I see that there are also comments in the blog post correcting that, so it seems to be correct. I had a look at ACT, and it really seems like overkill. If I have to create a database and a network share to install the program which lets me work around the problem then I'll just give up. I'm not desperate enough to want to jump through all these hoops. – Peter Taylor – 2011-01-13T14:16:42.893

For this particular program, you can get around the UAC requirement:

Instead of running Pencil normally, create a shortcut to evolus\pencil\xulrunner.exe, and then add --app ..\app\application.ini to the end, so the short cut is:

"C:\Program Files (x86)\Evolus\Pencil\xulrunner\xulrunner.exe" --app ..\app\application.ini

This will let you run Pencil normally, without UAC.

Source: http://code.google.com/p/evoluspencil/issues/detail?id=275

Steven Noto

Posted 2011-01-13T11:39:58.537

Reputation: 286