Saturday, October 28, 2006 4:05 PM bart

Windows Vista - Demand UAC elevation for an application by adding a manifest using mt.exe

Introduction

Assume you're writing some application that really - I mean really really - needs administrative privileges (does it? you must be kidding). So, you want it to run evelated as an administrator. How to tackle this requirement in a Windows Vista and UAC world where even an administrator is locked down on the machine?

This post shows you how to create an application manifest for your .NET application (I'll be using C# for that purpose) that tells Vista to run the application evelated.

The application

Creating the Windows Forms app

Create a simple Windows Forms application called UacDemo. On Form1.cs add a single label called label1, and add the following line to the Form_Load event handler:

label1.Text = new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator) ? "Yup" : "Nope";

new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator) ? "Yup" : "Nope";

This time I'm assuming you're an administrator on the machine. Launch the application and see how "Nope" stares you in the face telling you're not as powerful as you thought you were:

Creating a manifest

In order to make the application support elevation, we need to define a manifest for the application. It's just a simple XML file with the following in it:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<
assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"

   <
assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="UacDemo" type="win32"
/>
      <
trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"
>
      <
security
>
         <
requestedPrivileges
>
            <
requestedExecutionLevel level="requireAdministrator"
/> 
         </
requestedPrivileges
>
      </
security
>
   </
trustInfo
>
</
assembly>

Add a file called UacDemo.exe.manifest to the project and copy/paste the XML chunk in there.

Adding the manifest to the executable

The last thing to do is to embed the manifest in the executable as a Win32Resource. An embedded resource is VS2005 can't be used for this. It's a little more complex than this. With the SDK, a tool called mt.exe ships that can be used to manage manifests in executables (for gurus, perform a dumpbin on the .exe file before and after the execution of mt.exe to see the application manifest being copied to the file). We'll be invoking this tool as a post-build step by going to the project properties, tab Build Events and pasting the following in Post-build even command line:

"$(DevEnvDir)..\..\SDK\v2.0\bin\mt.exe" -manifest "$(ProjectDir)$(TargetName).exe.manifest"  –outputresource:"$(TargetDir)$(TargetFileName)";#1

This looks as follows:

The test

Compile the project and go to the bin\Debug folder in Windows Explorer. Notice the application is now displayed with a security shield icon on it:

Let's try to run it. This should bring up the following prompt:

Now we are elevated and we finally see the happy "Yup" word:

Conclusion

So, now you now how to make your app UAC ready when it needs administrative rights and privileges. However, it's always better to avoid this level of rights and privileges. As usual: think before you do!

Del.icio.us | Digg It | Technorati | Blinklist | Furl | reddit | DotNetKicks

Filed under:

Comments

# Windows Vista の新しい UAC の機能 (セキュリティ) でコードが起動しなくなる場合の対処について

Wednesday, November 01, 2006 4:20 PM by 松崎 剛 ブログ (Tsuyoshi Matsuzaki Blog)

こんにちは。 Microsoft On で出ずっぱりで、ブログが停滞しすみません。 今日は、そんな Microsoft On で非常にご質問の多い、上記について方法概要しかご回答できていませんので、手順の詳細を記載します。(昨日のセミナーでもご質問を受けました。)

# User Access Control Elevation in Vista

Thursday, December 14, 2006 10:10 PM by Infosys | Microsoft

I recently came across this nice article on how to get the UAC elevation request working for our own applications in Vista. There are however one or two additional observations that I wanted to capture. First is that the behavior is...

# Add a manifest file to a c# project.

Thursday, December 21, 2006 8:38 PM by James Geurts' Blog

I came across a nice article describing how to add a manifest file to a c# project. You'll probably run

# Windows Vista UAC - Further Reading

Thursday, January 04, 2007 2:40 PM by Software/Technology Discussion

Then and Now Microsoft Windows XP™ initially creates all user accounts as local administrators. Administrators

# Come elevare i privilegi di un'applicazione .NET

Monday, January 22, 2007 2:54 AM by Around and About .NET World

# Come elevare i privilegi di un'applicazione .NET

Monday, January 22, 2007 2:54 AM by Around and About .NET World

# VISTA UAC Elevation &laquo; Wave a dead chicken

Sunday, April 08, 2007 10:18 AM by VISTA UAC Elevation « Wave a dead chicken

# Demand UAC Elevation for an Application

Monday, July 09, 2007 12:08 PM by Anderson On...

The UAC messages can get as annoying as the Apple advertisements suggest, but if you haven't considered

# &raquo; logview4net and Windows Vista

Monday, July 09, 2007 11:05 PM by » logview4net and Windows Vista

Pingback from  &raquo; logview4net and Windows Vista

# Vista, UAC elevation and MSBuild &laquo; The Dumping Ground

Tuesday, July 24, 2007 1:06 PM by Vista, UAC elevation and MSBuild « The Dumping Ground

Pingback from  Vista, UAC elevation and MSBuild &laquo; The Dumping Ground

# Demand UAC elevation for your Apps

Thursday, July 26, 2007 3:45 AM by Tiernans Comms Closet

Writing an app that needs administration access on Vista? Want it to prompt the user to run your App

# Adding Manifest to .Net Application &laquo; MaHesG&#8217;s Blog

Pingback from  Adding Manifest to .Net Application &laquo; MaHesG&#8217;s Blog

# How do I mark a shortcut file as requiring elevation?

Wednesday, December 19, 2007 7:40 AM by Noticias externas

Specifying whether elevation is required

is typically something that is the responsibility of the program

# MSDN Blog Postings &raquo; How do I mark a shortcut file as requiring elevation?

Pingback from  MSDN Blog Postings  &raquo; How do I mark a shortcut file as requiring elevation?

# How to mark a shortcut file as requiring elevation? &raquo; D' Technology Weblog: Technology, Blogging, Tips, Tricks, Computer, Hardware, Software, Tutorials, Internet, Web, Gadgets, Fashion, LifeStyle, Entertainment, News and more.

Pingback from  How to mark a shortcut file as requiring elevation? &raquo; D' Technology Weblog: Technology, Blogging, Tips, Tricks, Computer, Hardware, Software, Tutorials, Internet, Web, Gadgets, Fashion, LifeStyle, Entertainment, News and more.

# Johan; thinking out loud. &raquo; logview4net and Windows Vista

Pingback from  Johan; thinking out loud. &raquo; logview4net and Windows Vista

# Berechtigungs (Administrations) Check? - .NET Caf? @ tutorials.de: Forum, Tutorial, Anleitung, Schulung &amp; Hilfe

Pingback from  Berechtigungs (Administrations) Check? - .NET Caf? @ tutorials.de: Forum, Tutorial, Anleitung, Schulung &amp; Hilfe

# Impossbile creare un file su c:\windows con VISTA | hilpers

Thursday, January 22, 2009 9:52 PM by Impossbile creare un file su c:\windows con VISTA | hilpers

Pingback from  Impossbile creare un file su c:\windows con VISTA | hilpers

# programm hat keine Rechte auf Programme ordner - Forum Fachinformatiker.de

Pingback from  programm hat keine Rechte auf Programme ordner - Forum Fachinformatiker.de

# .Net deployment &laquo; The Dumping Ground

Friday, April 24, 2009 12:48 AM by .Net deployment « The Dumping Ground

Pingback from  .Net deployment &laquo; The Dumping Ground

# Learn all about developing for UAC in Vista

Wednesday, September 16, 2009 7:10 AM by Learn all about developing for UAC in Vista

Pingback from  Learn all about developing for UAC in Vista

# UAC Manifest &laquo; typesafe

Sunday, November 01, 2009 11:00 AM by UAC Manifest « typesafe

Pingback from  UAC Manifest &laquo; typesafe

# Grill restaurant - Restaurant river - Salt creek grill restaurant

Pingback from  Grill restaurant - Restaurant river - Salt creek grill restaurant

# Internet Sandboxes and Digital Signatures &laquo; akutz&#8217;s blog

Pingback from  Internet Sandboxes and Digital Signatures &laquo; akutz&#8217;s blog

# Non posso creare un file - Visual Basic .Net - MasterDrive.it

Pingback from  Non posso creare un file - Visual Basic .Net - MasterDrive.it

# horoscopes

Friday, December 23, 2011 4:21 PM by horoscopes

Pingback from  horoscopes

# horoscopes

Friday, December 23, 2011 4:21 PM by horoscopes

Pingback from  horoscopes

# Windows Vista の新しい UAC の機能 (セキュリティ) でコードが例外を出す場合の対処について

Sunday, November 18, 2012 7:31 PM by 松崎 剛 Blog

環境: Windows Vista RC1 こんにちは。 Microsoft On で出ずっぱりで、ブログが停滞しすみません。 今日は、そんな Microsoft On で非常にご質問の多い

# Fix Origin8.exe.manifest Errors - Windows XP, Vista, 7 &amp; 8

Pingback from  Fix Origin8.exe.manifest Errors - Windows XP, Vista, 7 &amp; 8