impossible to change privilege level of an app ?

[hackerman1]

impossible to change privilege level of a program ?

hi !

a few days ago a-squared began asking for elevated privilege, W7 showing an UAC-prompt everytime a-squared started a scheduled scan or i opened the GUI.

i checked the properties of a2start.exe which is the main file, under compatibility, the privilege level is set to "Run as admin".

i´ve tried to change it by using "Change settings for all users", but when it starts it doesn´t show the "Run as admin" as marked.

i tried to mark it, and then to unmark, but after clicking ok, it´s still marked as "Run as admin".

i switched to my admin-account and checked the file, it is NOT marked !
it´s only marked on my USER-account...

how do i change that ?

 

[A Guy]

It's likely because A Squared updated the version a couple of days ago. Have you tried turning off UAC and attempting the same thing from the Admin account? You may be well served to reinstall and run the installer as admin. For some reason, UAC sees the new version, and doesn't recognize it's admin authority. Mine doesn't even have run as admin checked, and no problems. A Guy

 

[hackerman1]

perhaps you missed this above: "i switched to my admin-account and checked the file, it is NOT marked !
it´s only marked on my USER-account..."

i already asked about it on Emsisoft´s forum, a2´s now requires to run elevated ( UAC-prompt ) ? - Emsisoft Support

got a very quick reply from the Developer himself, it took 4 minutes, can you believe that ?
MINUTES, not hours or days....
WOW !

and he didn´t mention any changes in a2.
i also have Windows Server 2008 installed, and of course i also use a2 with WS-2008.
so i shutdown W7 & started WS-2008 instead, also running on a normal USER-account,
after having updated a2 to the same version as on W7 i did same tests,
on WS-2008 a2 behaves exactly as before, no elevation required, no UAC-prompt.

on WS-2008 a2start.exe is NOT marked as "Run this program as administrator",
so it´s definitely a problem with my W7-system.

i don´t think you really understand the problem, because as i see it, it´s not a problem with UAC, the problem is that the file has somehow got changed privileges.

and the installer of course runs as admin, because it requires admin-rights...

 

[Barman58]

Would running the executable at start-up via the scheduler with "run with highest privileges" work in this case - just an idea as it should take away link to a particular user profile

 

[hackerman1]

hmmm, taskscheduler as admin or user ?

 

[WindowsStar]

hi !

a few days ago a-squared began asking for elevated privilege, W7 showing an UAC-prompt everytime a-squared started a scheduled scan or i opened the GUI.

i checked the properties of a2start.exe which is the main file, under compatibility, the privilege level is set to "Run as admin".

i´ve tried to change it by using "Change settings for all users", but when it starts it doesn´t show the "Run as admin" as marked.

i tried to mark it, and then to unmark, but after clicking ok, it´s still marked as "Run as admin".

i switched to my admin-account and checked the file, it is NOT marked !
it´s only marked on my USER-account...

how do i change that ?

Maybe I am missing something here, so I read this 3 times, plus read the part you posted on a2 web site.

Instead of playing with the "Change settings for all users", mark and unmark, why not turn off compatibility mode all together?

Plus you were saying you are running the application from a shortcut, why not delete the shortcut and make a new one??

Maybe some screen shots would help; you know picture is worth a thousand words.

 

[Bill2]

You can get rid of the UAC prompt, at least when opening the GUI by creating an elevated shortcut.

http://www.sevenforums.com/tutorials/11949-elevated-program-shortcut-without-uac-prompt-create.html

 

[hackerman1]

yes i know, but i want to know how to change privilege level...

 

[Barman58]

Ok my understanding of this as a non programmer is that we are dealing with two levels of "Privilege" here.

There are the actual file permissions which are part of the NTFS file system. These are fully controllable via the methods we all know, (and love ). This system is the same as it has been since the first days of NT. There is also the "privilege" level that an application needs to manipulate the objects it works with.

The facts are now complicated by the addition of UAC into the mix, and it's use of the dual token system for administrators, plus the fact that the Privilege level required for the running of an application is set in the program code. Some programs will trigger the UAC prompt whatever is set in the compatibility mode settings. This is triggered by the program itself or by the security system when the program attempts to access an object that requires a higher privilege level the the one it is running at.

Without changing the actual code of the application, and the ACL's of all files that may be accessed by the application, all we can do at a user level are workarounds, to prevent the trigger of the UAC prompt, the application must run at the privilege level it requires to access and change the files it uses.

The "Admin Shortcut" mentioned above is probably the most useful for system type applications, as the trigger in the Task Scheduler may be set to system start or user login (Standard or Admin).

This is of course my simplistic understanding of this and any of our accomplished programmers here will be able to explain this much more clearly

 

[TimStitt]

Hi hackerman1,

What if the issue is a change in your PC's config, not Emisofts'? Check secpol.msc User account control settings, especially two in the screen prints I took below. The pics show the defaults for Windows 7.

I'll have a bit of a think and see what else sprigs to mind, will let you know if I come up with something.

PS: I know you said you haven't changed anything; but please check anyway; besides you may be able to massage your settings here to make it work (balance that with security of course ).

 

[hackerman1]

hi !

thanks for the tip about secpol.msc.
but i can´t check that now.
yesterday i decided that i had wasted too much time on this.

so i uninstalled a2, then i tried to start a2.exe from another folder in which i have another a2-installation for WS-2008,
that a2start.exe had normal rights BEFORE i uninstalled a2 from W7.
but AFTER the uninstall it got changed to "Run as admin" !

so i then reinstalled a2 to another folder with another name, as i suspected i would get the same problem again otherwise.

now everything is normal again with a2, no UAC-prompts anymore.
the a2start.exe in the WS-2008 installation is still marked as "Run as admin"...

a small note: i use a common program-partition for both W7 & WS-2008.

 

[TimStitt]

Another thought, since you're talking to the programmer, it might be a good idea to shoot him/her off a list of your users token privileges and to see whether they are fully fledged tokens, filtered tokens or something less likely to receive an admin prompt. The programmer would know what tokens are required to run their software (you could always ask for this too) and from the comparison you should be able to see exactly what's causing your issue.

Open an elevated command prompt and type whoamI /priv into a command prompt and post it here. NOTE: The whoamI /priv does work from a normal command prompt; but you only get a partial list of results.

About tokens
As far as I can remember.... and there's likely to be holes in my knowledge *grin*. When you sign into windows you receive 2 access tokens, one for group membership and another for authorization and access control, fully fledged tokens are granted to:
Built-In Administrators
Power Users
Account Operators
Server Operators
Printer Operators
Backup Operators
RAS Servers Group
Windows NT 4.0 App Compat Group
Network Configuration Operators
Domain Administrators
Domain Controllers
Certificate Publishers
Schema Administrators
Enterprise Administrators
Group Policy Administrators

i tried to find an MS article on the above, other than in my onenote's but I couldn't sorry. But I did find this info on whoamI /priv that you might find useful.

Good Luck
Timo

 

[TimStitt]

hi !

thanks for the tip about secpol.msc.
but i can´t check that now.
yesterday i decided that i had wasted too much time on this.

so i uninstalled a2, then i tried to start a2.exe from another folder in which i have another a2-installation for WS-2008,
that a2start.exe had normal rights BEFORE i uninstalled a2 from W7.
but AFTER the uninstall it got changed to "Run as admin" !

so i then reinstalled a2 to another folder with another name, as i suspected i would get the same problem again otherwise.

now everything is normal again with a2, no UAC-prompts anymore.
the a2start.exe in the WS-2008 installation is still marked as "Run as admin"...

a small note: i use a common program-partition for both W7 & WS-2008.

Congratulations on persevering and getting it working *sigh of relief*.

There are particular folders like 'system32', 'windows', 'program files' that require stronger tokens and force the UAC prompt. I wonder if your new folder was not one of these?

 

[hackerman1]

hi !

i´ve been using a2 for long and i have never seen this before, until a few days ago.
Emsisoft has not changed anything in a2, it´s running now, without any "admin-rights" for a2start.exe, a scheduled scan also starts normally without any UAC-prompts.

somehow something got changed on my computer.
before uninstalling i also tried to "Take ownership" of a2start.exe, but it didn´t help...

maybe i CAN find something in secpol.msc, since the other a2start.exe in the WS2008-folder had the privilege level changed when i uninstalled a2 from the W7-folder,
which btw. i think is weird.
i´m going to take a look...

There are particular folders like 'system32', 'windows', 'program files' that require stronger tokens and force the UAC prompt. I wonder if your new folder was not one of these?

hmm, now you make me confused....:huh:

my "new" a2-folder for W7 is "E:\Program files\a2".
and the problem has now disappeared...
the old a2-folder was also on E.

i have several partitions, i use a system-partition for each O/S, all other programs are installed on a separate program-partition which is common for both O/S´s.

here is a detailed description about my system:
http://www.sevenforums.com/performance-maintenance/92465-few-tips-about-performance-etc.html

when running W7:
W7=C
WS2008=D
Programs=E

a2 is not installed on C, so i don´t understand what "windows" & "system32" has to do with it ?

i´m also going to check whoamI /priv.

 

[hackerman1]

hi!

Hi hackerman1,

What if the issue is a change in your PC's config, not Emisofts'? Check secpol.msc User account control settings, especially two in the screen prints I took below. The pics show the defaults for Windows 7.

I'll have a bit of a think and see what else sprigs to mind, will let you know if I come up with something.

PS: I know you said you haven't changed anything; but please check anyway; besides you may be able to massage your settings here to make it work (balance that with security of course ).

i´ve checked secpol.msc:

"Behavior of the elevation prompt for administrators in Admin approval mode"
is set to: "Prompt for consent on secure desktop"

"Behavior of the elevation prompt for standard users" is set to:
"Prompt for credentials on secure desktop"

 

[WindowsStar]

Just a quick note:

If you are sharing "E:\Program files\a2" between Windows Server 2008 and Windows 7, you need to realize that Windows Server 2008 = Windows Vista, there have been issues with Vista and 7 sharing the same applications in the same folder(s). -WS

 

[hackerman1]

hi !

NO, a2 is installed in 2 DIFFERENT folders.
it also was before the problem started...

have i explained this so badly ? :huh:
sorry !

a2 was installed on the same partition but is 2 separate folders:
in W7: "E:\Program files\EAM"
in WS2008: "E:\Program files\EAM WS 2008"

i uninstalled a2 from W7, and then deleted "E:\Program files\EAM".

then i tried to start a2´s main file (GUI) a2start.exe from "E:\Program files\EAM WS 2008".

THAT a2start.exe had normal "Privelege level" BEFORE i uninstalled a2 from "E:\Program files\EAM".
i know it because i checked the properties of a2start.exe in "E:\Program files\EAM WS 2008" BEFORE i uninstalled a2 from W7.
i also started a2start.exe, and it started without any UAC-prompts.
i then checked the properties of a2start.exe again, still no change.

but AFTER a2 was uninstalled from W7 it got changed to "Run as admin" !
i had a suspicion it would happen....

a2 is now installed to a new folder "E:\Program files\a2" and everything is back to normal,
except a2start.exe in "E:\Program files\EAM WS 2008", which still has a changed privilege level.

 

[WindowsStar]

NO, a2 is installed in 2 DIFFERENT folders.
it also was before the problem started...

That is good, I just wanted to note it, just in case.

 

[hackerman1]

hi !

when i installed WS2008, after having done the workstation conversion,
i decided to install a2 in a new folder for WS2008 just because it could be some compatibility-issues with a2.
and i really didn´t want to get any security-problems on W7, caused by some WS2008-problems, because a2 is my primary A/V, although i also have MSE, Avast & MBAM installed, i normally use only a2 for realtime-protection.

 

[TimStitt]

Hi Hackerman1,

I can't say with certainty how the tokens are affected with the sharing of program files on different disks. I can only guess that whoever is the owner of the disk/folder (W7 or S2008) might affect the tokens and whether or not it's recognized as a "Program Files" folder, could even be the logged in user?

I have S2008 and W7 on different partitions as well although my program files are localized.You have me curious and I'd like to test this further! Unfortunately it's exam week for me so I've no time to set up your scenario and check it. It might be interesting to check whoamI from both OS' and compare this to secedit and folder permissions and ownership. I'd be curious to find out if any are different and if changing them alters the admin prompt scenario.

RE: Secpol

hi!

"Behavior of the elevation prompt for administrators in Admin approval mode"
is set to: "Prompt for consent on secure desktop"

"Behavior of the elevation prompt for standard users" is set to:
"Prompt for credentials on secure desktop"

Note the difference in your "Behavior of the elevation prompt for administrators in Admin approval mode"
I'm pretty certain that the default should be "Prompt for consent for non-windows binaries"

I didn't mention previously but "Behavior of the elevation prompt for standard users" should be "prompt for credentials".

Perhaps WindowsStar or another reader can verify theirs?

-Timo

PS: You've probably already noted this, but our timezone differences may make for delays in my replies.