TCMADMIN v.s. __COMPAT_LAYER

[MVV]

I don't like when UAC asks for elevation for applications that don't require it (if I'm sure that it is so): old programs, programs with "setup" or "patch" words in their names or simply programs with special level requirement in a manifest. And now I found a perfect way to disable UAC questions for applications with highestAvailable or even requireAdministrator levels! All I need is just to define special environment variable __COMPAT_LAYER:

Code: Select all

set __COMPAT_LAYER=RunAsInvoker

Windows doesn't ask for elevation if process has this variable defined in its environment (except when I directly choose 'Run as Administrator').

Unfortunately I found a problem with TC: TCMADMIN doesn't work well, I can't do file/folder operations with elevation.

Christian, please take a look on it, it is really cool thing that may improve security (since it allows to run unknown applications w/o administrator rights). If you're using ShellExecute to launch TCMADMIN, it is better to use "runas" verb instead of default "open" in Vista/7, it triggers elevation always (or asks for administrator credentials if user doesn't belong to administrators group). It won't cause any other issues.

[ghisler(Author)]

No wonder that it doesn't work, TC launches tcmadmin and relies on the manifest to launch it directly.

Are you sure that it would work with "runas" even if you set this variable?

[MVV]

Yes. My Sudo tool uses ShellExecuteEx with "runas" verb, and it asks for elevation when I call it from TC with __COMPAT_LAYER=RunAsInvoker.
Anyway, you can easilly test it.

Code: Select all

@echo off
set __COMPAT_LAYER=RunAsInvoker
start "" "%COMMANDER_PATH%\TOTALCMD.exe"

[ghisler(Author)]

I just fear that it may have some other negative side effects. I will try it with TC8 and check the reactions, but will not change it in TC 7.57. But maybe I should not change it now even in TC8, people have asked not to add any new features now...

[MVV]

I understand, but it is not a feature, it is just a little fix. You need only to change verb for ShellExecute function that starts TCMADMIN so it will trigger elevation regardless of manifest and compatibility fixes.

A pair of pages where this verb is mentioned:
http://blogs.msdn.com/b/vistacompatteam/archive/2006/09/25/771232.aspx
http://en.wikipedia.org/wiki/User_Account_Control

[MVV]

Thanks, works perfectly in TC8b21, now we can use __COMPAT_LAYER=RunAsInvoker w/o any problems.

[ghisler(Author)]

Let's hope that it doesn't have any negative side effects...

[MVV]

I doubt that side effects are possible since runas just triggers unconditional elevation, and TCMADMIN requires it anyway.

[ghisler(Author)]

What if someone defines a different "runas" verb in the registry for EXE files? I haven't tried that yet, but it might cause problems.

[MVV]

I think he will have problems with elevating. No one normal user will do it.

Just checked it now, elevation via context menu executes runas action (its IsolatedCommand value - exactly the same as ShellExecute with runas uses). So modification of this parameter will cause generic problem with elevation, not only for TCMADMIN.

[ghisler(Author)]

OK, we will see...