InstallSite Blog : UAC

False Positives in Windows 7's Installer Detection

stefan — Wed, 24 Jun 2009 15:18:00 GMT

When User Account Control (UAC ) was introduced in Windows Vista it would have caused problems for many existing setups because they required full administrator permissions. Therefore Microsoft added heuristical detection for installers. For instance if it detects a keyword like “setup” or “installer” in the exe file name or in the resources it assumes that this is a setup program and displays the UAC prompt to elevate the program to the full administrator token. This can however cause problems if your program actually isn’t a setup but is falsely identified as one by the installer heuristic (“false positive”). To avoid this you could add a manifest to your application to tell Windows Vista that it’s not a setup.

Windows 7 has similar functionality, but it ignores the information you put in the manifest for Windows Vista – you have to add another piece of data especially for Windows 7. Chris Jackson, who is an Architect and the Technical Lead for the Windows Application Experience SWAT Team, blogged about this problem, and a possible fix.

PCA Changes for Windows 7: How To Tell Us You are Not an Installer, Take 2 (because we changed the rules on you)

Why UAC isn’t a security boundary, and how auto-elevation works on Windows 7

stefan — Thu, 11 Jun 2009 08:44:10 GMT

Mark Russinovich (of SysInternals fame and now employed as a Technical Fellow at Microsoft) has published an interesting article about User Account Control (UAC) in the July issue of TechNet Magazine.

He discusses the goal of UAC, why it could be circumvented by malware, and how auto-elevation on Windows 7 avoids elevation prompts from system tasks.

http://technet.microsoft.com/en-us/magazine/2009.07.uac.aspx

UAC in Windows 7

stefan — Thu, 06 Nov 2008 21:49:28 GMT

At PDC2008 there was a session abstract that essentially said: "there's nothing new here". But I'd still recommend viewing it, and actually it included (a little bit of) new information:

PC51 Windows 7: Best Practices for Developing for Windows Standard User
presented by Crispin Cowan, PM on the UAC team

The important takeaway is that from a programmer's perspective the UAC functionality in Windows 7 is the same as in Windows Vista. There is some fine tuning so that some actions don't require elevation anymore, like changing the DPI of your monitor. A major change is that the UAC prompt behaviour is now configurable by the user (more details below), but programs should still be created for and tested with the tightest UAC setting.

The presenter explains what problems user context switching in an "over-the-shoulder" elevation scenario can cause, how to launch an elevated process from a non-elevated process, and other design guidelines with restricted users in mind. He also explains why launching an application or readme at the end of an elevated setup can be a problem, and that per-user configuration should not be handled by the installer but by the application at first run. Finally he expresses his concerns about per-user installs.

UAC Configuration Options

Here are some screenshots from the UAC configuration dialog in Windows 7 (taken from the M3 build that was handed out to PDC attendees).

In the highest setting the UAC behavior is the same as in Windows Vista.

The second option is similar to the first one, but the UAC prompt is displayed like any other window, not on the secure desktop. According to Crispin this mode is intended for machines with problematic video drivers which cause the screen to turn black for as long as 30 seconds when switching to the secure desktop. This mode is less secure because a malicious program could remote-control the UAC prompt. It can be handy however if you want to take a screenshot of the UAC dialog.

The third option is the default (at least in this build). It gets the UAC prompt out of the way for any tasks you perform manually. So for instance a user can create a folder under Program Files without being prompted. I don't know how Windows 7 can safely distinguish between user actions and programmatic actions, and what would happen if a tool like AutoIt sent keystrokes or mouse clicks to an application.

The last option turns UAC off completely. This requires a reboot of the machine, and instantly changes your security status to red, similar to Windows Vista.

I noticed that the shield icon on buttons performing actions that require elevation is always displayed, even if the UAC prompt is set to option 3. This means that you don't actually get a UAC prompt when you click a button with a shield on it. I find that confusing.

Finally, now that taking screenshots from UAC dialogs is easier, here's the "friendly" UAC dialog that's displayed when uninstalling a digitally signed package from the Programs and Features control panel (aka ARP), which I mentioned in my previous PDC post.

Note: The screenshots in this article were taken from a pre-beta build of Windows 7, so things may look and/or behave differently in the beta or RTM.

Video: Windows Installer and Application Compatibility

stefan — Mon, 21 Jan 2008 16:57:04 GMT

Microsoft's Channel 9 posted a video interview with Robert Flaming, program manager on the Windows Installer team. Robert talks about topics like User Account Control (UAC), chainers, restart manager, nested install custom actions, digitally signing setups and patches.

Watch the video or download as video or audio podcast:

Application Compatibility - MSI Installer Issues

Setup Guidelines for UAC Compatibility

stefan — Mon, 13 Aug 2007 12:46:05 GMT

An article in the Altiris community blog lists best practices that should be followed to make sure your setup works as intended on Windows Vista with User Account Control (UAC).

Guidelines and Best Practices to Achieve UAC for Applications on Vista

German: dotnetpro 9/07 - WiX 3 und Benutzerkontensteuerung (UAC)

stefan — Wed, 08 Aug 2007 12:56:00 GMT

(This article is only available in German)

Auch das neue Heft 09/2007 der Zeitschrift dornetpro behandelt wieder Themen, die für Setup-Entwickler interessant sind.

Unter dem Titel "Installationsroutinen mit Windows Installer XML 3" stellt Andreas Kerl die Struktur und die wesentlichen Sprachmerkmale von WiX-Dokumenten sowie die Neuerungen in WiX Version 3 vor. Andreas arbeitet als Windows Installer Fachmann bei Microsoft und hat die Bücher Inside Windows Installer und Windows Installer 3.1 verfasst.

Ein Artikel von Achim Oellers befasst sich mit "Benutzerkontensteuerung und Virtualisierung unter Windows Vista" und welche Probleme daraus entstehen können.

In der Rubrik "Tipps und Tricks" widmet sich Andreas Maslo Setup- und Update-Tools.

Darüber hinaus enthält das Heft noch zahlreiche weitere Artikel für professionelle Software-Entwickler:

Inhaltsverzeichnis

dotnetpro gibt es nur für Abonennten, die Zeitschrift ist nicht am Kiosk erhältlich.

Es gibt ein kostenloses Zwei-Monats-Probeabo, das allerdings erst mit dem folgenden Heft beginnt. Als Abonnent kann man jedoch auch alle bisherigen Ausgaben online abrufen.

Korrektur (22.08.2007): Man kann auf der dotnetPro-WebPage Einzelhefte nachbestellen und einzeln abrechnen. (Danke an Andreas Wittig für den Hinweis)

How to trigger UAC elevation from a script

stefan — Mon, 02 Jul 2007 19:23:00 GMT

If you need to run command with full administrator permissions in Windows Vista, you could use the elevated command prompt (by right-clicking the command prompt icon in the start menu and selection "run as administrator). However if you need to do this from a batch or script file you have to use a trick, as described in these two articles:

VBScripts and UAC elevation by Ramesh Srinivasan, Microsoft MVP
Scripting Elevation on Vista (uses JScript) by Aaron Margosis, Microsoft Consulting Services

Note that these scripts will trigger the UAC dialog and the user must click "proceed". Thats by design to keep it secure.

In-depth analysis of Vista UAC

stefan — Wed, 20 Jun 2007 06:41:00 GMT

An article has been posted at The Code Project that examines how UAC on Windows Vista operates behind the scenes, including a debug session of an elevation via the UAC prompt. It also shows how to work with UAC using manifests or the CreateProcess API, including source code.

In-depth analysis of Vista UAC and the creation of CreateProcess...Elevated() APIs

Beware of the UAC Prompt Timeout

stefan — Wed, 18 Apr 2007 17:01:00 GMT

Recently I encountered a strange problem when I tried to install an MSI based setup on Windows Vista. I ran through the dialog sequence and clicked the “Install Now” button. The progress bar dialog was displayed as usual, and I left the computer to get a cup of coffee, expecting that the software would be successfully installed when I return.

But to my surprise on my return I was greeted with the “Setup was interrupted before the software was installed” dialog. In the log I found the following entries:

MSI (s) (00:B8) [15:02:24:944]: MSI_LUA: Elevation required to install product, will prompt for credentials
MSI (s) (00:B8) [15:04:59:002]: MSI_LUA: Credential Request return = 0x800704C7
The operation was canceled by the user.
MSI (s) (00:B8) [15:04:59:052]: MainEngineThread is returning 1602

MSI error 1602 means “User cancelled installation” and error code 0x800704C7 translates to “The operation was canceled by the user”. But of course I did not cancel the installation. Michael Urman of Macrovision helped me to understand what was going on, and I was able to reproduce the problem - without coffee ;-)

Some time after the progress bar dialog was displayed, the UAC consent dialog came up and asked me if I wanted to proceed. After two minutes of waiting, the UAC dialog disappeared automatically and the setup was cancelled.

So the UAC Prompt has a 2 minute timeout after which the operation is cancelled automatically without user interaction. This timeout, which I didn’t find documented anywhere, applies to other UAC prompts as well, like control panel actions that require elevation etc.

Unfortunately the return code 0x800704C7 doesn’t indicate whether the operation was cancelled by the user or by the timeout.

Note that there actually was that UAC shield icon on the “Install Now” button, but it was too subtle to make me wait for the UAC dialog. In my tests I have seen delays of more than one minute after the Install Now button was pressed until the UAC dialog came up.

I contacted the Windows Installer team at Microsoft about this problem. Tyler Robinson, the Lead Program Manager, told me that both the MSI team and the UAC team are aware of the issue, but they don’t have a solution at this time. He identified two main factors that are causing the delay:

System Restore. For compatibility reasons the restore point for the setup is created before the UAC prompt is displayed. Turning off system restore can speed things up.
Digital signature verification. UAC has to verify the digital signature of the msi package because the UAC dialog has a different banner color and text for setups that have a valid digital signature, as described here. Depending on the size of the .msi file this verification can take a while.

So if you have users complaining that the setup failed unexpectedly on Vista, ask them whether they saw the UAC dialog.

Types of UAC prompt dialogs and how to remote control them

stefan — Wed, 07 Feb 2007 14:23:00 GMT

An article in the Windows Vista Team Blog shows the various types of UAC prompts and in which case (singed or unsigned executable etc.) which type is displayed. The screenshots are a bit tiny but you get the idea.

By default, other applications cannot send messages to the UAC dialog because it's displayed on the "secure desktop", which is basically a screenshot of your real desktop (see the clock in the system try doesn't update). This is to improve security. However in some cases it is necessary to "remote control" the UAC dialog, like a screen reader for visually impaired users. This can be done by manifesting the application, as described in the article UI Automation Security Overview on MSDN.

7 Reasons Why your Installations May Fail on Windows Vista (And How You Can Fix Them)

stefan — Wed, 07 Feb 2007 13:34:00 GMT

An article that I've written for the December 2006 issue of the Macrovision DevLetter.

7 Reasons Why your Installations May Fail on Windows Vista (And How You Can Fix Them)

Windows Installer is not just a technology but also a set of rules and best practices. While these rules have been specified in the SDK for several years, many of them haven't been enforced. While ignoring these rules didn't break your setups in the past, installations that don't follow best practices may eventually fail on Windows Vista™. This article alerts you to the most common pitfalls in setup authoring and helps you troubleshoot your installations to be compatible with Windows Vista.

http://www.macrovision.com/company/news/newsletter/tips/is_vista.shtml

Updated link to the Flexera Software web site:
http://www.flexerasoftware.com/webdocuments/PDF/is_vista.pdf

Launching a program when setup is completed may be a security issue

stefan — Fri, 22 Dec 2006 07:53:00 GMT

An article in the InnoSetup knowledge base points out that launching your application or displaying a readme file (using notepad for instance) at the end of your installation may cause a security issue on Windows Vista. The problem arises if the installation runs with elevated privileges because the child process (your application or notepad) inherits these privileges. This means that now your application runs with full administrator rights, which defeats the purpose of UAC.

This is a problem for all setups that don't use Windows Installer technology, like InnoSetup or InstallScript projects in InstallShield. But MSI based setups can also be affected.

If you launch an .msi file (by double clicking or via msiexec.exe) on Windows Vista, only custom actions that are scheduled for deferred execution in system contect (i.e. with the NoImpersonate flag set) will run with elevated privileges. Ususally you wouldn't launch your application with such an action, but instead use a DoAction event on the Finish button on the "setup complete" dialog. In this case you're fine.

However if you launch your MSI install using a setup.exe which is not explicitly manifested to indicate that it doesn't need elevated rights, the UAC prompt will be displayed right at the start, and your whole user interface sequence will run with elevated permissions. In this case the launched application will inherit these permissions.

In general it may be best not to launch the application at the end of the installation. Note that similar security problems can also happen on Windows versions before Vista, for instance if the setup was launched using RunAs with administrator privilges. And if a reboot is required to complete the installation, your application may not run properly when launched from the Finish dialog anyway.

MSDN Magazine article about UAC (in multiple languages)

stefan — Thu, 21 Dec 2006 11:10:00 GMT

An MSDN Magazine article that talks about User Account Control (UAC) on Windows Vista and also covers setup topics is available online.

There are several localized versions of this article. If your language isn't detected automatically you can select a language from the drop down box in the upper right corner.

Teach Your Apps To Play Nicely With Windows Vista User Account Control
http://msdn.microsoft.com/msdnmag/issues/07/01/UAC/default.aspx

Important Windows Installer WebCast: Designing Installations for User Account Control (recording available)

stefan — Fri, 13 Oct 2006 15:15:00 GMT

Windows Vista includes a new feature call User Account Control (UAC) which has the potential to break many existing MSI-based setups.

UAC is a really, really important topic. Although Vista isn't released yet, I'm seeing multiple reports of broken setups. It's time to understand UAC and prepare your setup for Vista NOW!

In this presentation, the Windows Installer team at Microsoft will cover the new installation features that specifically relate to User Account Control, such as marking a package as UAC-compliant, taking advantage of UAC patching, and adding the "shield" icon to your user interface. They also address common UAC debugging issues pertaining to application installation and servicing.

Usually there's a Q&A session at the end of the presentation, so you may want to have your UAC questions and problem descriptions at hand.

Wednesday, October 18, 2006
10:00 AM Pacific Time (US & Canada) which is equivalent to 17:00 UTC, 18:00 BST, 19:00 CET (other time zones)

Registration: http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032307311

Update:

A recording of this webcast is now available at the same URL.

A log of the Q&A chat that took place during the webcast has been posted at
http://blogs.msdn.com/windows_installer_team/archive/2006/10/19/new-windows-installer-4-0-webcast-scheduled-and-q-a-from-lua-webcast.aspx

How UAC in Vista will impact your Setup (updated Oct 3)

stefan — Fri, 22 Sep 2006 07:28:00 GMT

Windows Vista introduces a security concept called User Account Control (UAC) which has multiple impacts on Windows Installer (MSI) based setups. Robert Flaming, Product manager on the MSI team at Microsoft, is posting a series of articles on his blog that explain what these changes are, and how they may break existing setups. So this is not about new features in MSI 4 that you may want to add to your setup some time in the future - it is about what you need to do NOW to make sure the setups you build TODAY will work on Vista.

Update (Sep 26): additional articles are available
Update (Oct 3): even more articles and some Q&A

The following article are already available:

Introduction

Architecture Insights

Common Package Mistakes

More Architectural Insights

Conversations with Customers