User Account Control, the feature in Vista that causes installers and some applications to require "elevation" to administrator privileges to run, cuts both ways. It’s designed to protect users from apps that try to make system-level changes by giving the user the heads up that it’s about to happen and gives the user the chance to abort the operation. The flip-side is that since this is an inconvenience to users, software writers are motivated to write their software so that it doesn’t require admin privileges, further improving security on the system.<\/p>\n
While there are problems with UAC, the most aggravating (for me) is that Vista insists on elevating some apps that don’t need elevation. For example, all setup.exe programs always<\/em> elevate, since most users don’t want setup programs failing halfway through. Other programs, like regedit.exe, have manifests that say to Vista, in effect, "I can run in user mode or admin mode, but give me admin mode if it’s available". So when a non-admin account launches regedit.exe, regedit comes up without requesting elevation. But if an admin account launches regedit, the UAC dialog comes up. Fair enough. <\/p>\n But what if I don’t want<\/em> to elevate an app that wants it? For example, if I didn’t want regedit.exe to have admin privileges to help protect me from myself when I only intended to modify HKEY_CURRENT_USER, which doesn’t require admin rights. <\/p>\n But the more common scenario I find myself in is when I download software I do not entirely trust. The software comes with a setup program, which I have to run in order to use the software. I intend to install the program in a private user area rather than Program Files in order to avoid having to elevate the program or its setup program. But Vista always insists on elevating setup.exe programs. <\/p>\n There is<\/em> a way to coerce Vista to not<\/em> elevate a process that it otherwise would. <\/p>\n Ironically, starting a program explicitly without elevation requires an elevated command prompt. Go figure.<\/p>\n So next time an untrusted program prompts for elevation that you don’t want to give, try this nifty command.<\/p>\n","protected":false},"excerpt":{"rendered":" User Account Control, the feature in Vista that causes installers and some applications to require "elevation" to administrator privileges to run, cuts both ways. It’s designed to protect users from apps that try to make system-level changes by giving the user the heads up that it’s about to happen and gives the user the chance […]<\/p>\n","protected":false},"author":2685,"featured_media":37840,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[4617],"class_list":["post-193","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-permierdev","tag-andarno"],"acf":[],"blog_post_summary":" User Account Control, the feature in Vista that causes installers and some applications to require "elevation" to administrator privileges to run, cuts both ways. It’s designed to protect users from apps that try to make system-level changes by giving the user the heads up that it’s about to happen and gives the user the chance […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts\/193","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/users\/2685"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/comments?post=193"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts\/193\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/media\/37840"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/media?parent=193"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/categories?post=193"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/tags?post=193"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}REM The next command MUST be run from an elevated command window.\r\nREM It launches regedit.exe WITHOUT elevated privileges.\r\nrunas \/trustlevel:0x20000 regedit.exe<\/pre>\n