How to force to run any setup/program/file without admin rights?

[Win7 WINNN]

I have been looking for the answer to the question like forever and to this day I cannot find solution that would completely solve the problem.

Let me be straight from the beginning, I actually want to FORCE (!) any file to run without admin rights 100% of the time without any exceptions whats so ever! And I really don't care about any "It won't work properly", "It won't work at all" or any other similar tears. I just want that program at the very least would try to run without admin rights.

Right now most of the troubles I have with some installation files. Most setups don't even need admin rights to install correctly or they need admin right only for some small component that usually isn't necessary for me so I really don't mind if it wouldn't be installed in the first place and yet, they like literally demand (!) admin right for the whole installation process. You can clearly see the proof of that when you for example install some program on one system and then simply copy and paste installed files to the other system and the program works fine without admin rights despite the fact that it desperately required admin right to be installed onto the first system.

By far the best answer to my question that I managed to came myself is the use of "RunAsInvoker" command, but unfortunately it doesn't work all the time. Some setups are so damn stubborn, that they completely ignore "RunAsInvoker" thing and refuse to go one step further without admin rights. The alternative would be to install such program onto another system (e. g. virtual machine) and then copy and paste installed files onto primary machine, but that isn't really practical. Ideally I'm looking for something like "RunAsInvoker" that works 100% without any exceptions of absolutely (!) any kind.

Any ideas?

And also, could anyone tell me where the hell gone good old "customer is always right" principle? I (!) want to decide whether program needs elevated privileges or not, not the program...

 

[LMiller7]

Let me be straight from the beginning, I actually want to FORCE (!) any file to run without admin rights 100% of the time without any exceptions whats so ever!

Not possible.

Applications have the ultimate control over what account they must be run under and there are a wide variety of ways this can be enforced if an application chooses to do so. Some applications can be coerced into other behavior but not all. In many cases they require an admin level account because what they do cannot be done with less. Forcing the application to run with a lower level account (if possible) would have unpredictable results.

If an application needs admin rights to do it's job it is appropriate that it refuses to run with a lower level account. Most programmers would agree. That is just good programming practice.

 

[Win7 WINNN]

<...> would have unpredictable results.

Like an error message? Very well, I would take that! And then I would work with that error and find out reasons of that error. Maybe setup can't install or program work only because it doesn't have access to the specific registry entry? I would feel more comfortable by giving access rights to that specific registry key instead of giving unlimited access for a program to do whatever program wants to do.

Most programmers would agree. That is just good programming practice.

I'm not a programmer, but I'm pretty sure that you are right. However, I'm talking from the house owners point of view. I want that all my guest in my house behave according to my rules! It's my house after all!

I support the idea that such behavior would be enabled by default, because most people don't really know much about computers and in such cases it's actually smarter to let program makers decide whats best for customers, but to force such nonsense upon every single one of us at the very least is very disrespectful.

 

[Win7 WINNN]

By the way, Windows XP don't have such nonsense and I never heard any bad stories related to it.

 

[LMiller7]

Unpredictable means just that.
Maybe there will be an error message. Maybe not.
Maybe the application will behave in an unusual way.
Maybe the application will crash.
Maybe the application will appear to work properly, but does not.
All of this and more is possible.

I stand by everything I have said 100%.
I am a programmer (amateur) and have some experience in these matters.

 

[Win7 WINNN]

You have right to have your opinion, but I didn't really come here to discuss which way is the best, I just came here to find the solution to the previously mentioned problem.

I don't really agree with your "Not possible", as I said before, you can install program on virtual machine and then copy and paste installed files onto primary machine thus eliminating the need to give program admin rights for installation onto primary machine. Although it's an indirect and quite impractical solution, but it kinda achieves the main goal. So, can't really say "Not possible". I just hope that someone here will have much brighter and maybe more "out of the box" ideas.

EDITED:
Anyone outside of this forum is welcome to register and post here your ideas, even if the registration would be just for that.

 

[Megahertz07]

Do you have an administrator account?
I don't know if it is what you want, but if you want to get rid of the "are you real, real sure you want to..." kind of message, go to Control panel - Action center - Change user account control settings - Set it to never notify.

 

[Barman58]

Windows is designed to work in a specific way - you are licensed to use the windows software, you do not own it, the conditions for it's use are contained in the End User Licence Agreement that you agree to when installing, ( or use for the first time)

However, stating that ...

You can revert to the outdated and unsafe, (total lack of) security model used in the obsolete XP systems by enabling, and then using, the so called Hidden administrator, but you are then seriously at threat from modern threats that were not present during the XP period

Built-in Administrator Account - Enable or Disable

The current Dual token administrator account system used with current windows is a convenient version of the best practice used by IT professionals for many years including on XPired - Have two accounts, One low security for day to day use, and an administrator account for administrative activities.

Remember that any malware or nefarious access acts on your system with the rights of the user in place at the time of the attack so if you do go for XP level security in the modern world - please ensure you do regular full system images and data backups as you will likely need them sooner rather than later

 

[Win7 WINNN]

Do you have an administrator account?
I don't know if it is what you want, but if you want to get rid of the "are you real, real sure you want to..." kind of message, go to Control panel - Action center - Change user account control settings - Set it to never notify.

That doesn't really solve the problem, it just changes the response from providing UAC screen to providing a message that you need admin rights to install such program. Setup still doesn't even try to move forwards, it just sees that there is no admin rights available and stops immediately even so the road is usually wide open for installation. I mean that if you can normally launch and work with program that you didn't really install on primary system (just copied installed files from another system), then it's kinda obvious that the announcement "you need admin right to install me" isn't really very reasonable.

 

[Win7 WINNN]

You can revert to the outdated and unsafe ...

Correct me if I'm wrong, but you are basically talking about the easiest way to grant admin rights for programs and I'm trying to completely avoid that.

 

[Barman58]

The only way to remove the rights required by programs is to completely re-write them and / or the OS, there is no other way.

This was also the case in older versions of windows NT style operating systems (Win 9.x had no security at the system level). windows XP faked the old way of working in the 9.x windows versions, for the home market, by making every user a full administrator, which made it look like the users did not need admin rights to install Programs, Drivers , Printers Etc. - They did but it was not obvious to the user.

It was actually common practice in NT, Win2000 and thus XP to create all users as Administrator accounts and leave the correction to the System / Server Admin to reduce the rights to safe levels, or leave them as local rights and constrain them at the network level.

 

[Win7 WINNN]

The only way to remove the rights required by programs is to completely re-write them and / or the OS, there is no other way.

That what I was afraid of... If you are truly right and there really is no direct approach to the problem, then it leaves with some indirect solutions. Maybe someone will offer some easy to live workaround, creative "out of the box" idea.

Or maybe there is some bug/glitch that might not be officially considered as a bug/glitch in Windows 7 OS that could be exploited in a way that would allow to achieve the goal? For example, that to me looks like a very serious bug and a massive hole in Windows security, but obviously people at Microsoft thinks otherwise, because, to my best knowledge, this security issue isn't fixed to this day. Maybe something similar exists for my problem.

 

[Barman58]

Just to try to explain a little clearer

The rights, (or lack of rights) that are triggering the messages you are receiving are a part of the operating system rather than the actual programs. There are many examples that show this in the way that a program behaves differently if the program is ran by an administrator than when run by a non administrator - if the program is asked by the user to perform some task or access some file which are given Admin Only protection it depends on the user rights whether this action is completed, not the programs limits. Some programs can only work as an administrator due to the jobs they are designed for and these will normally trigger the admin elevation required message directly to save later checks and processing but most are triggered by the OS when the program attempts to access a protected object.

The reason for the amount of protected objects ( files, processes, folders, Etc), has risen dramatically in the later versions of windows is due to the need to defend against the modern sophistication of malware but a lot of access restriction has always been there, just hidden by the subterfuge of all administrative users.

The link you show is not a major bug in that I am confident that given access to a physical system most cybercriminals and IT Professionals could quite easily gain access to the contents of the hard drive - encrypted data would still be safe although the subtle addition of physical removal and remote storage of the hard drive is even better and standard practice in truly secure systems - of course the value of the data itself is a major factor in the need for security level employed - it's unlikely that any criminal will break into my property to steal to personal info

 

[Barman58]

One way that may work is to remove all security on every object that can be changed - ie every file, folder, and registry entry in the system ( a task almost akin to making eggs from an omelette). but this would have to be performed by the hidden administrator account in order to circumvent the added security performed by the TrustedUser account.

if you have a specific activity that is causing you an issue, (or just annoyance), changing the permissions on specific objects, may remove the restrictions with an acceptable level of work although this might take a fair amount of trial and error to achieve as any modern OS is a complex system

 

[Win7 WINNN]

Just to try to explain a little clearer

Thank you for the explanation, it's much clearer now, but it's kinda annoying that program makers, OS creators think that they know better that I what is best for me... I rather receive message "Sorry bro, can't install myself because I can't access Programs Files directory. Either give me appropriate rights or change installation location" instead of "If you won't give me admin rights, I won't install no matter what".

 

[Win7 WINNN]

One way that may work is to remove all security on every object that can be changed - ie every file, folder, and registry entry in the system ( a task almost akin to making eggs from an omelette). but this would have to be performed by the hidden administrator account in order to circumvent the added security performed by the TrustedUser account.

if you have a specific activity that is causing you an issue, (or just annoyance), changing the permissions on specific objects, may remove the restrictions with an acceptable level of work although this might take a fair amount of trial and error to achieve as any modern OS is a complex system

Process Monitor might help here, but I kinda have feeling that some setups don't install purely (!) because they see that user doesn't have admin rights. Such setup might have access to absolutely everything it might need, but if it checks that user doesn't have admin right, that's it, it won't do anything else. Am I wrong for thinking like that?

 

[Barman58]

The admin rights system is the very permission you are requesting but is so designed to protect you and your system from those criminals that want to gain access to your system to rob you. I know that my personal bank account is not something that would allow a criminal to live in luxury, but empty a hundred or a thousand or a million such accounts and that is worth their efforts.

They are to blame for the security hike in recent software - yes it's a right royal PITA but I consider it necessary for my ease of use over what I always used and I understand the developers adding it these days as I'm sure I could foresee an awful lot of litigation from people whose systems are hacked if the security was not in place - Sad but the world we live in I'm afraid

 

[Win7 WINNN]

To clear things up.


My basic wish is that programs/setups/etc would work in the environment that were launch in and that they would do as much as they can on those rights that they have. Some programs does exactly that, for others a little push with "RunAsInvoker" is necessary, but some of them are so damn stubborn...

 

[Win7 WINNN]

This whole thing to me looks like a big security concern. If I know that some program will work just fine or fine enough without admin rights, then it immediately rises the question why this program so desperately demands for admin rights even when I'm pushing it with "RunAsInvoker"? What else such program is trying to do/install besides the obvious?

 

[Barman58]

Some developers are more compliant to Microsoft's development Guidelines, (rules), than others. I've forgotten the number of times that programs fail with a new OS or even system update due to the fact that a developer made a direct call to a system process rather than use the designated MS system variable, (which changes the location correctly when it actually changes).

I think there is a similar error in some programming for the admin requirement

I've seen games and other Utilities that have an admin requirement due to the developers being to lazy to move the storage location for the game parameter settings (.ini file) from the Install folder in Program Files to the user AppData folder where the permissions are correct ( this has been a "requirement" from before the release of XP and the end of the 9.x line).