Elevate application's privilege to Administrator automatically on Vista

Recently I'm focusing on an installer engine for a series of product. We choose .NET framework 2.0 as infrastructure and expect it  running  on  XP and Vista.

As well-known, Vista uses stricter security policy. Even if you log in as Adminstrator, the application launched by you will run with standard user privilege by default.

So if you want your application to run with Adminstrator privilege, you should right-click it and select "Run as Administrator" in the context menu. It annoying and troublesome.

After some surfing, I found the solution for this issue and think it's worth writing down for later reference.

Here is the original URL:
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=463884&SiteID=1

Modify embedded manifest

In VS 2005, the C/C++ IDE interface that permits the inclusion of additional manifest files in the target .exe does some processing on the XML and inserts a duplicate xmlns tag.  This duplicate tag exacerbates an XP schema parsing bug resulting in a crash on XP.   Because of this, the previously documented method on how to include a manifest in a Visual Studio 2005 c++ project cannot be used if it is desired that the file run on Windows XP also.  In general , the manifest needs to be modified in two ways.

 

1)    A schema version of 2 should be used instead of 3 in the trustInfo section

2)    The additional xmlns field in the trustInfo section needs to be removed.  See Example A.

 

Example A:

 

<ms_asmv2:trustInfo xmlns:ms_asmv2="urn:schemas-microsoft-com:asm.v2" xmlns="urn:schemas-microsoft-com:asm.v2">

 

Should be this:

 

<ms_asmv2:trustInfo xmlns:ms_asmv2="urn:schemas-microsoft-com:asm.v2">

 

Updated procedure

 

Although a patch is planned for Windows XP to correct the XML parsing bug, developers need a way to deploy the same build of the application on both Windows XP and Windows Vista without relying upon this fix.  The procedure described below will permit this scenario.  

 

A fix is also planned for the mt.exe tool to address the problem where it generates mal-formed XML.  Until a new version of mt.exe is available, the current version can still be used, but in only in q manner where the merge feature is not used.

 

If you are not using Visual Studio, you basically just need to change the version number in the trustInfo line of the manifest from v3 to v2.  If you are using Visual Studio 2005, follow the steps outlined below.

 

C/C++ project type:

 

Open your project in VS

Under project, Select properties:

Go to manifest tool->Input and Output

Remove any entry you have in the Additional manifest files line.

Rebuild the application.

 

At this point, you should have your app with only the default manifest that VS installs.  It should not contain the trustInfo statements…

 

Manipulate the manifest in the .exe directly using mt.exe.  mt.exe is included with Visual Studio.  From a command prompt, extract the current manifest from the file.

 

        mt.exe –inputresource:YourApp.exe;#1 –out:temp.manifest

 

Open temp.manifest with an text editor like notepad.  It may look something like this:

 

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">

  <dependency>

    <dependentAssembly>

      <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50608.0" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>

    </dependentAssembly>

  </dependency>

  <dependency>

    <dependentAssembly>

      <assemblyIdentity type="win32" name="Microsoft.VC80.MFC" version="8.0.50608.0" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>

    </dependentAssembly>

  </dependency>

  <dependency>

    <dependentAssembly>

      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

    </dependentAssembly>

  </dependency>

</assembly>

 

Now we’re going to insert the trust info into this manifest using a text editor like notepad.  It should then look something like this:

 

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">

  <dependency>

    <dependentAssembly>

      <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50608.0" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>

    </dependentAssembly>

  </dependency>

  <dependency>

    <dependentAssembly>

      <assemblyIdentity type="win32" name="Microsoft.VC80.MFC" version="8.0.50608.0" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>

    </dependentAssembly>

  </dependency>

  <dependency>

    <dependentAssembly>

      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

    </dependentAssembly>

  </dependency>

 

   <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> 

      <security>

        <requestedPrivileges>

          <requestedExecutionLevel

            level="asInvoker"/>

        </requestedPrivileges>

      </security>

   </trustInfo>

 

</assembly>

 

Note: make sure you use <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">  instead of .v3

 

Use mt.exe to insert this new manifest into the file.

 

                mt.exe –manifest temp.manifest –outputresource:YourApp.exe;#1

 

You should now be able to run your executable on both Vista and XP.

 

 

Managed code (c#, j# and VB)

 

Visual Studio does not currently embed a default manifest into managed code.  For managed code, the developer would simply insert a default manifest into the target .exe using mt.exe.  The steps would be as follows:

1.     Use a text editor like notepad to create a default manifest file, temp.manifest.  Here is a default manifest that can be used as a sample.

 

  <?xml version="1.0" encoding="UTF-8" standalone="yes"?>

  <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">

      <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">

          <security>

               <requestedPrivileges>

                   <requestedExecutionLevel

                       level=”asInvoker”/>

               </requestedPrivileges>

          </security>

      </trustInfo>

  </assembly>

 

 

2.     Use mt.exe to insert the manifest.  The command would be:

 

mt.exe –manifest temp.manifest –outputresource:YourApp.exe;#1

Use correct version of mt.exe
Please copy the newer version of mt.exe from <VS2005 root folder>/Common7/Tools/Bin  into the <VS2005 root folder>/VC/bin folder.

The newer mt.exe (version is 6.0.4071.0) does not create the malformed manifest that the older version (version is 5.2.3790.2075) does.  Obviously having a correct manifest does not crash/hang XP any more and with new trustinfo there you get proper UAC interaction on Vista.

The same three mt.exe shipped in VS2005 so this solution existed from the beginning.

Side note: <VS2005 root folder>/SDK/v2.0/bin also contains the same older mt.exe version (5.2.3790.2075).