Shortcuts on Vista

Sample script

Hi Anders,

I attached a simple script which is utilizing the UAC plug-in.
I signed the created installer before tested it.

The described problem with the multiple security warnings is not happening on Vista when you execute the installer direct from the hard drive.

It only happens on Vista when you run the installer out of a web page what means it gets downloaded and executed by IE7 and JavaScript without saving it to the hard drive.

I hope this will help you to figure out the problem.


Thank you very much for your help

M.

It still gets executed from the hard drive, just in the temporary internet files folder. I guess thats why you get the "c:\user\<account>\AppData\Microsoft\Wind..." path in the dialog, and the name installer[2].exe would indicate that this is the 2nd time you "ran it from a website". I'm not sure how any of this is related to UAC, other than the fact that you might get one extra warning from IE. It might be possible to check if $exedir is the temporary internet files folder and to copy your installer to $temp and then execute that.

Hi Anders,

I really think that the UAC-plugin makes it different in matter of security warnings.

For example if I run my simple test installer out of a web page without UAC-plugin i get the warnings:
- "File Download - Security Warning" download/run permission
- "User Account Control" elevate process

With UAC-plugin and basically the same test installer i get:
- "File Download - Security Warning" download/run permission
- "Internet Explorer - Security warning" run inst. as user
- "Open File - Security Warning" run installer as admin
- "User Account Control" elevate process

There must be a way that you can use the UAC-plugin with only the 2 security warnings as stated above.
Otherwise it could easily scare users away with so many warnings.

M.

nope, I don't think there is anything I can do. If you copy your installer out of temporary internet files and into $temp AND remove the "mark of the internet" (NTFS stream) you might be able to get rid of two warnings (you must do this before calling the uac plugin in .OnInit). Signing your installer might also help. This is a IE only issue that I don't really care about to be honest (you could also wrap your real installer inside a smaller one that just extracts the real thing to $pluginsdir/$temp and executes it)

plugin problems

When using the plugin the UAC dialog comes up minimized. This is bad because the user might miss it, even though it is flashing in the task bar. Once I click on the UAC icon I get the normal modal dialog with the desktop darkened.

Is this normal or am I doing something wrong?

unroar: which version of the UAC plugin are you using?

The comment in uac.cpp say it's version v0.0.6c - 20071014. I got the download from the wiki link.

When you say minimized, are you sure its not just BEHIND other open windows? If you drop by the NSIS IRC channel I might be able to provide you with some test builds

Latest version on the wiki should now fix the behind and/or minimized bugs (Hopefully) It also contains some other fixes, everyone should test the new build (It will probably be the last, the UAC plugin really needs a fresh start, I'm not sure when I'm up for doing that, if ever, you can still report bugs ofcourse and I will try to fix 'em)

hi i am a complete novice and need to use this plugin. where do i start? i have downloaded the zip file and extracted it, thats as far as i can get haha.

I guess you are better off not using it at all then if thats as far as you got on your own. You are probably better off using:

RequestExecutionLevel admin
SetShellVarContext all
and don't use the run checkbox on the finish page
If you need be admin on other NT versions aswell, you can use the UserInfo plugin that ships with NSIS to check in one of the init functions

Nice work on the UAC plug-in Anders 😉. I have been using it for several months, allowing me to perform a post-install launch without propagating the high privileges of the installer to the child process.

Unfortunately, I have encountered a problem with the UNICODE build (built here /w VS2008). I am using it in conjunction with the UNICODE build of NSIS. I do not know which is at fault, but I suspect first the UAC plug-in.

I am getting a general failure in Windows x64 (unable to elevate). It appears to work in x32, though I have did have one user report of a failure to elevate for the x32 build -- leaving me unconfident.

I intend to so some debugging soon, but I figured I would ask here to see if anyone else has seen this, or if anyone is using this combination successfully for installations in Windows Vista+ x64.

Thanks!

Nevermind all.. My build of the UAC plug-in was bad. VS2008 had pulled in the CRT due to buffer security checks being enabled, and I had accidentally linked to the DLL version of it. This therefore caused a UAC.DLL load error on systems where the CRT DLLs weren't installed. Duh! Problem solved. I should have looked closer before posting here.

After removing the CRT dependency, all was well. My unicode build of the UAC plug-in ended up being 19KB, only 2KB larger than the official multi-byte distribution of it.

I can say now that the UAC plug-in definitely works great with the unicode build of NSIS 😉.

when the next official release comes out (who know when that will be) it will ship with both versions so you don't have to recompile if you are not changing the source

Originally posted by Anders
when the next official release comes out (who know when that will be) it will ship with both versions so you don't have to recompile if you are not changing the source

Thanks Anders, I'm sure that will be helpful to many people -- and probably reduce the number of support requests you are bothered with, lol 😉.

I attached a unicode build of Ander's UAC plugin to this post, in case it is helpful to anyone in the interim. This is version 0.0.11c.

I really appreciate your work on this plugin. Without it, I would have had to quit using NSIS.

Anders

Congratulations on the work you have done on the UAC plugin.

One strange problem I have encountered is as follows:
Windows 7 RC 1
A non-admin user
The install elevates and installs successfully using an admin user as the inner process. If I uninstall via Start Programs it elevates and works correctly. The paths are correctly identified via UAC as the outer user. However if I uninstall via the Control Panel (same nsi code and uninstall.exe) it elevates, but the install fails as the paths for the Data directory, the desktop icon and start menus are the inner (elevated admin) process and not the (outer) user.

If I run on XP both uninstall routes (Start menu and Control panel) elevate and work successfuly for a non-admin user.

I have worked on the problem for some time, but no luck.
Any help would be much appreciated.

It may well be a Windows 7 problem - I am about to submit as a problem to Microsoft. Any thoughts?

Paul

Vista and 7 will force the elevation for you IIRC (I'm sure this only happens when you put the uninstall info in HKLM)

You should stop creating stuff as the user and do a pure all users install (HKLM & SetShellVarContext all) if you don't want to deal with problems like this (Using the UAC plugin to launch a program during install is fine, anything else means your installer is broken and you will have issues like this)

Anders, you seem to be saying that NSIS + UAC plugin is broken if you try a user install. Do you really mean this, as it seem to me that the inconsistent behaviour on Windows 7 (uninstall.exe works via the start menu shortcuts, but fails through the Control Panel)is more likley a Windows bug? It's as though the windows 'executation context' of uninstall.exe, when launched via the Control Panel is different from that when done via the start menu. (I don't have a Vista system handy, so have not yet tried this on Vista.)

Well, it depends on what you mean by user install (In a real single user install, you would not call into the UAC plugin to perform operations since you are already running as the correct user and you will only write to HKCU and the users profile, not in HKLM or $programfiles)

I would not call this problem a windows bug even tho starting from a shortcut is not the same as starting from the control panel, since, if the uninstall info is in HKLM, you did a "all users" install and you will require admin rights to uninstall so windows just "helps you along"

So, if you run into this problem, it probably means you did a "mixed install" and this has never been correct (I know the UAC plugin really helps you do this, but it was not the original intent of the plugin, its only "supported" function is to run programs during install, not to create files or do any special action at all during uninstall)

Anders - thanks for such quick replies.
I take your point about the mixed install, which is not a good idea and I think I am guilty of doing this inadvertently. Also, the subtlety that the uninstall.exe was created with the correct paths (during the elevated install) had escaped me.
Thanks again, Paul

Hi, I am using the UAC plug-in, it works well for me. Just I have a requirement to suppress UAC if it is on, in order to let the installation process pure automatically, without any user interfere. Is it possiable through this UAC plug-in? If not, what should I do?

Thanks

june1212, please don't post the same question twice, it causes fragmentation of the answers.

--> Answered in http://forums.winamp.com/showthread....hreadid=313496

Hello over there,

I've a question regarding the UAC plugin and creating a Mutex to find out if the installation program is already running.

As far as I noticed the program is going to be run twice - in normal mode and in admin mode, if you confirm it. So if I create a mutex in onInit, it will be executed twice and then fail.

How do I prevent this?

Thank you for your great plugin!

The topic I posted my question first is:

Thread: CreateMutex Help Topic - Post #32
Post: Post #32 - Single Post View

Edit: Ok - I've a solution for my problem! Because we are going to check if there is an update required first before we execute the uac dialog I had to wrap it into those checks. And I create the mutex only if we have admin rights and the application can be installed. (see attachment)

I'm going nuts with the lack of documentation, and I can't find source code anywhere. Would it be possible to get a zip with the source uploaded to the wiki? http://nsis.sourceforge.net/UAC_plug-in

I'd be more than happy to add some documentation if I can get the source.

I have a question about using UAC plug-in.

I try to run setup from the non admin user and get "Run as" dialog box.
Then I fill 'user' field and 'password' field leave empty.
Then I get error something like "empty passwords are not allowed".

What could I do?

Originally Posted by ivansobaka View Post

I have a question about using UAC plug-in.

I try to run setup from the non admin user and get "Run as" dialog box.
Then I fill 'user' field and 'password' field leave empty.
Then I get error something like "empty passwords are not allowed".

What could I do?

This is a windows policy, probably Limit local account use of blank passwords to console logon only: http://technet.microsoft.com/en-us/l...8WS.10%29.aspx

Hello everyone,

thanks a lot for the great plugin! But I have troubles with UAC_AsUser_ExecShell / ExecShell - I want to execute an application as user but with administrative rights, because the launched application is storing some information in %APPDATA%.

- If I use ExecShell the information are stored in the administrators %APPDATA%

- If I user UAC_AsUser_ExecShell the information are stored in the users %APPDATA% BUT the application is not running in admin mode, so I can't changes files within my launched application.

Is there a way to run the application in admin mode but using the users scope variables?

Thank you very much!

Originally Posted by klopfdreh View Post

I want to execute an application as user but with administrative rights, because the launched application is storing some information in %APPDATA%.

This is not possible. Either it's running as admin, or it's running as user. It can never be both at the same time.

However, there is an easy solution to your problem: Use the UAC plugin to call a function as user (and make sure to use SYNCREGISTERS), and in that function copy the value of $APPDATA to a register:

Function SyncAppdata
setshellvarcontext current
StrCpy $0 $APPDATA
FunctionEnd

This way, you'll have the user's appdata path stored in $0, in the inner (admin) instance of your installer. Then, you can simply supply that user-appdata path as a commandline parameter to your application.


Edit: Here's two macros I created to do something similar, namely synching the contents of a variable, and synching the flags of sections, from outer to inner: http://pastebin.com/eM9MDUYL (Note that you shouldn't sync the $APPDATA variable using that syncvariable macro, because then the admin's $appdata will point to the wrong path. But you can modify it to suit your needs.)

Thanks a lot - Im going to evaluate that solution, soon.