Not running elevated, though the UAC prompt is accepted (custom action)

Question

I have build an installer by using wix, that includes custom actions that need administrative rights.

At the moment this installer only works, when it is executed by the buildin administrator account. In this case, no UAC prompt is shown.
If the installer is executed by any other member of the local administrators group, the UAC prompt is shown. Though I allow to do changes to my computer, the windows api functions in my custom actions return errors like "missing privilege", ...

I have tried to let the custom actions execute deferred, but this did not help.

I'm running out of ideas, so your help would be very welcome.

Regards Ralf

Answer 1

Try running the custom actions with the msidbCustomActionTypeNoImpersonate flag (set Impersonate to "no"): http://msdn.microsoft.com/en-us/library/aa368069(VS.85).aspx

This way it will run under the local system account with full privileges. Please note that your actions should be deferred in order to use this flag.

Answer 2

as far as I know the install script is executed by the LocalSystem account. As it seems (look http://msdn.microsoft.com/en-us/library/ms684190) several privileges are disabled in this account. For example SE_BACKUP_NAME is DISABLED and this one is needed to call LoadUserProfile.

I have already experimented with AdjustTokenPrivileges API function but without success. Does the LocalSystem account have the TOKEN_ADJUST_PRIVILEGES? I don't know the related SE_XXXXXX_NAME privilege.

Regards Ralf

Answer 3

The solution I found out was I merged my installer with a bootstrapper which will prompt for UAC if user does not have appropriate rights.

If you dont want to use this approach this code might help you.

public static ActionResult CheckPrivileges(Session session) {

        bool isadmin = false;

        System.Security.Principal.WindowsIdentity wi = System.Security.Principal.WindowsIdentity.GetCurrent();
        System.Security.Principal.WindowsPrincipal wp = new System.Security.Principal.WindowsPrincipal(wi);

        if (wp.IsInRole("Administrators"))
            isadmin = true;
        else
            isadmin = false;

        if (isadmin)
        {
            return ActionResult.Success;
        }
        else
        {
            if (System.Environment.OSVersion.Version.Major >= 6) // Windows Vista or higher
                MessageBox.Show("Administrator priveleges are required to install the application. Please right click the setup file and select 'Run as administrator'.", "Mesaage", MessageBoxButtons.OK, MessageBoxIcon.Error);
            else
                MessageBox.Show("Administrator priveleges are required to install the application.", "Mesaage", MessageBoxButtons.OK, MessageBoxIcon.Error);

            return ActionResult.Failure;
        }
    }