UAC not asking for system change confirmation

[trims30]

Am running with admin login on Win7 with UAC On -
Have program that modifies some registry keys in HKey_LocalMachine.

No matter what level of UAC protection I select, windows does not notify me to confirm changes and changes are actually saved in registry.

I am not running program elevated using Run As Admin.

What's the reason my Win7 and Win8 machines allow registry changes to be made without asking?

Any response is appreciated.

Lee

 

[oreo27]

I have no experience in this so I wouldn't know but maybe a couple of questions will help.

1. What particular application are you using?

2. Also, does the UAC prompt appear when performing other Administrative tasks? e.g. Installing an application

3. When you wrote "admin login", did you mean the built in Administrator account or an account with administrator privileges?

 

[trims30]

Program (MyProgram.exe) is one I wrote in VB.Net to save some settings in Windows Registry.

UAC prompt does appear when starting programs like Registry Editor (regedit), Control Panel/AdminTools/Services and the like.

Admin login refers to my login when I start Windows - My User Profile is Administrator.

If I just dbl click on MyProgram.exe it allows me to make changes to specific keys in registry and save them.
If I Right Click on MyProgram.exe and select RunAs Admin then the UAC prompt does appear.

Shouldn't the system always notify you when system changes are being made rather than running a program that might make system changes?

 

[gregrocker]

I would System Restore to a point before you edited the Registry, and refrain from doing so in the future without confirming its efficacy here.

If SysRestore won't help then run SFC /SCANNOW Command

 

[trims30]

No need to do a restore - I know what I'm doing. Just trying to understand why windows behaves as it does.

 

[gregrocker]

If UAC stopped working after your ran the regedit then it is not working. That's why it is behaving that way. Your edit acted like pernicious malware.

May I ask what you were trying to achieve with the regedit and exactly what it was?

I would apply the steps I gave you unless you want a crippled OS. You can disable UAC in Control Panel if that's the goal.

 

[derekimo]

I don't have an answer for you, but it would be interesting to see this program you made.

It may be useful for others to answer why it is running as it is.

 

[trims30]

Program is part of a commercial program we distribute and support. We store things like Data File Path and some other workstation configuration options in the registry rather than in an .INF or .XML file.

Our program uses standard windows API calls to modify the registry.

Some of our customers are reporting that in Win7 and Win8 with UAC ON their configuration options are not being saved and no error is given. Others are having no difficulty. Same software has been on the market since Windows 95 made it's debut. No UAC in XP and No Problem there. No reported issues with Vista - just Win7 and Win8.

 

[gregrocker]

You might try installing in Compatibility Mode or the program might need to be updated since tampering with UAC would make it malware.

 

[Alejandro85]

So, it's your own program only?
Does it saves to HKEY_LOCAL_MACHINE directly?
Does it explicitly modifies any permission?
How is it manifested, related to UAC?

 

[andrew129260]

Could be a corrupt user profile.
Since you know what your doing, I am guessing I don't need to link to tutorials.

If you enable the built in admin account, and set UAC to the highest setting (always notify) and restart, and then create a new user profile does the issue exist? Does the issue exist on a new created admin account or standard account?

But if you know what your doing I am assuming you would have already tried that.

Am I correct?

 

[trims30]

UAC is Always Notify
Rebooted
Logged in as myself
Created new Admin User
Logged Off
Logged in as new Admin User
Opened my ConfigurationEditor Program - No UAC Message
Made change to setup item stored in registry and saved it. - No UAC Message
Looked at registry and confirmed that changes were made and saved.
Isn't UAC supposed to give an alert in this situation?

Logged off and came back in using Guest Account
Did same sequence of events as above - still no UAC Message and was able to save change to registry.

Logged off Guest and Logged back in as myself
Ran Configuration Editor Program using RunAs Administrator and got the UAC Prompt.
Ran Again without As Admin - No UAC Prompt
Changed name of Configuration Editor.EXE to SETUP.EXE - Ran it and got UAC Prompt

Conclusion - UAC Warning comes up when using RunAs Administrator or naming Program Setup.exe, MyInstall.exe or something else to do with setup or install in file name.

Still have no answer to why a program that messes with the registry can get by UAC detection.

 

[andrew129260]

Does uac work when changing settings in windows if set to always notify? Since you stated uac is working if you rename the file, then it is working, but for some reason not for your program.

See here for possible more info/solution:

Determine How to Fix Applications That Are Not Windows 7 Compliant

freebasic.net ? View topic - How to make my installer UAC compliant?

Windows 7: The Definitive Guide: The Essential Resource for Professionals ... - William R. Stanek - Google Books

Writing a UAC compliant Application

Understanding The Windows 7 UAC

http://www.windowsecurity.com/artic...osoft-Windows-7-User-Account-Control-UAC.html

 

[Alejandro85]

Still have no answer to why a program that messes with the registry can get by UAC detection.

Because messing with the registry has nothing to do with UAC, and there is nothing like "UAC detection". It simply don't works like that.

UAC only prompts for elevation when something explicitly request elevation. It does NOT interferes with program execution and does NOT tries to guess what "changes" a program is doing. Contrary to what the Windows help texts says, UAC has really nothing to do with changes in the computer, and UAC will not notify when something tries to do changes in global areas. I suppose that those completely misleading texts are there for non-tech people, but you, as a programmer, must use the proper documentation to know how UAC really works and how to use it effectively.
The bunch of links that andrew129260 posted are quite good and accurate, they'll help you in understanding how to solve the problem.

To give a quick and dirty resume on what does trigger UAC prompt, from memory, I know those:

• A process is explicitly started "as administrator" by the calling process. The "Run as Administrator" in Windows Explorer context menu does this, allowing any program to be elevated
• The executable you're launching is manifested as "RequireAdministrator" in its security settings, in which case Windows will always try to elevate, regardless of the calling program asking for it or not. If your configurator program requires to be always elevated, this is what you must do (and why I asked previously, but it's quite evident by now that you haven't done so).
• If the executable compatibility settings say so, it will also prompt for elevation on each execution, something like the first case but automatically
• If Windows is configured to autodetect "installations" (by default it does so), any executable named like "setup", "install" and a few others I don't remember will also be elevated regardless of anyone explicitly asking for it. This is your case and why you saw that prompt. You should also never rely on it, as it's a backward compatibility feature (to allow older installers to elevate without knowing about UAC).

It's also worth noting that UAC elevation takes place only when the process is being created, and then never more, so that a program cannot be changed to run as admin if it didn't started as it from the beginning. Programs that need to elevate in the middle of an operation need to launch a second, elevated, process to do all the admin-only work.

 

[oreo27]

Still have no answer to why a program that messes with the registry can get by UAC detection.

Because messing with the registry has nothing to do with UAC, and there is nothing like "UAC detection". It simply don't works like that.

UAC only prompts for elevation when something explicitly request elevation. It does NOT interferes with program execution and does NOT tries to guess what "changes" a program is doing. Contrary to what the Windows help texts says, UAC has really nothing to do with changes in the computer, and UAC will not notify when something tries to do changes in global areas. I suppose that those completely misleading texts are there for non-tech people, but you, as a programmer, must use the proper documentation to know how UAC really works and how to use it effectively.
The bunch of links that andrew129260 posted are quite good and accurate, they'll help you in understanding how to solve the problem.

To give a quick and dirty resume on what does trigger UAC prompt, from memory, I know those:

• A process is explicitly started "as administrator" by the calling process. The "Run as Administrator" in Windows Explorer context menu does this, allowing any program to be elevated
• The executable you're launching is manifested as "RequireAdministrator" in its security settings, in which case Windows will always try to elevate, regardless of the calling program asking for it or not. If your configurator program requires to be always elevated, this is what you must do (and why I asked previously, but it's quite evident by now that you haven't done so).
• If the executable compatibility settings say so, it will also prompt for elevation on each execution, something like the first case but automatically
• If Windows is configured to autodetect "installations" (by default it does so), any executable named like "setup", "install" and a few others I don't remember will also be elevated regardless of anyone explicitly asking for it. This is your case and why you saw that prompt. You should also never rely on it, as it's a backward compatibility feature (to allow older installers to elevate without knowing about UAC).

It's also worth noting that UAC elevation takes place only when the process is being created, and then never more, so that a program cannot be changed to run as admin if it didn't started as it from the beginning. Programs that need to elevate in the middle of an operation need to launch a second, elevated, process to do all the admin-only work.

That's quite informative. Thanks

I did think of something. I recall that registry keys have permissions too right?

When I try to access a folder that is owned by another user, a UAC prompt appears and I have to give permission before I can do changes to these folders. Do registry keys work in the same fashion? It could be the reason that some registry keys require it, while some don't. I recall that a Windows Explorer window can request admin privileges after it's been opened in this scenario.