How to launch program with user permissions instead of active permissions

Question

I have a C# application which runs and displays a tray icon. I have an installer for my tray application which launches the application after installation. The installer requires admin permissions whereas the tray icon must be run with normal permissions. My installer currently breaks this - when the installed tray application is launched it inherits admin permissions from the installer process.

As part of my installer I am launching a C# application to perform some custom work. This small application currently launches the tray application by calling:

Process.Start(@"path/to/my/tray/app.exe"); 

Is there any way to invoke the tray app with the current user's permissions rather than the elevated permissions given to the installer?

I have heard that the recommended way to do this is to have a wrapper EXE around the installer which launches the installer then launches the installed program. I would like to avoid this if possible.

I am using WiX to build an MSI installer so I would also accept solutions which work directly from WiX/MSI.

Answer 1

There are two approaches. The simplest is to use a shell exe that first launches the admin task elevated (lots of ways to do this; I prefer a manifest) and then the other task non-elevated. If you refuse to do that for whatever reason then take a look at the blog post and CodePlex project I link to from my blog post on this: http://www.gregcons.com/KateBlog/NonElevatedFromElevatedManagedThisTime.aspx

Answer 2

Alternatively, you could use the Windows API CreateProcessAsUser, that seems to do the job.