Menu
Is there a way for an app to present the user with the UAC prompt only once, upon first running. Thereafter, no further prompting.
In other words, I understand that our app needs the user's UAC permission to do certain things. And that's fine. But we don't want it to have to keep asking on every occasion it runs. Can the user give permission to our app for all time? Or does what I am asking violate the fundamentals of UAC?
We are working with .NET and Windows 7
800
The answer to your question is: No, you cannot do that.
Microsoft specifically is forbidding such behavior. If a applications could add themselves to an exclude list, then we get back into the mess we had before.
What you need to do is make your program not require administrative access.
Ask yourself: What did you do on Windows XP?
Windows XP doesn't have the convince of the UAC. The only way for a user to run your program as an administrator is to logon with another user. And that's a much worse user experience than clicking "Continue".
If you don't want to write software that is standard user friendly, then you're part of the problem. UAC is not the problem, UAC is a convience. i can turn off UAC, run as a standard user full time, and your software still won't work.
Microsoft considered
If you had a white-list, then every program would just add itself to such a list at install time.
If such a white-list existed, then your app would be the target of malware. It would love to modify the binary to execute what it wants; since it knows the program will be silently elevated.
Malware would love to poke at your application with SendMessage, trying to pass invalid data or structures, trying to get your, administrative, application to execute the code it wants.
If the user had the option to disable future prompts on programs, then they would just do it, and every program would run as an administrator, and we'll be back to the way things were.
All those ideas don't solve the problem: almost no program actually requires administrative access.
The time has finally come to force developers to come to terms with that fact.
Some people want to come up with ways to make whitelists work.
Have a checkbox where the user can say, "Don't prompt me for this file anymore"
If you store that filename, then other programs with the same name will silently run as administrators.
Okay, then we'll record the full path, or use the hash of the file, as the whitelist entry. If there's a whitelist then other programs will add themselves to that list when they install, and have programs running with administrative access that the user didn't want.
What if only signed applications are allowed, that way we know they're safe. Applications are not safe because they're signed. An application doesn't have to be malware for it to be abused into doing bad things. (e.g. buffer overruns in flash, firefox, ie, chrome, safari, opera, word, photoshop, Yahoo image uploader tool).
You have to store list of valid code-signers in a list somehwere. And no matter how you slice it, having any white-list will mean that applications will just add themselves to that list.
And how do you manage the white-list? Lets say the user has changed their mind, or Dad has changed his mind, or IT has changed its mind, or corporate has changed its mind, or the software publisher changes their mind: how do you remove items from the list - especially when nobody is allowd to modify the list.
Summary: White lists cannot work.
160
The only way is to install yourself as a service or device driver.
33
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
