Security Xploded by Nagareshwar Talekar

Vista has introduced new feature called UAC (User Account Control). In short it basically controls the way in which applications are executed by different users. Due to this any application by default will run under the context of standard user instead of administrator. So if your application requires administrator privilege then it will fail to work properly on Vista. VistaUACMaker allows you to make your application VISTA UAC compliant easily and quickly.

Making Application Vista UAC Compliant

To make any application Vista UAC compliant one has to embed a manifest file specifying the privilege required by the application. Manifest file mainly contain 2 important information, privilege required by the application and UI interaction of application with other windows.

There are 3 types of privileges that can be mentioned in the manifest file.

     * requireAdministrator : Run as administrator
     * asInvoker : Run as same privilege as parent process
     * highestAvailable : Run with highest privilege available for user

Other than this, one has to specify if the application interacts with user interface of other high privilege applications. For example your application may send the message to modify the UI of other high privilege application. This is specified through following parameter

uiAccess : TRUE/FALSE

UAC Manifest File

Manifest file is generally put into the resource section of the application. Typical manifest file with administrator privilege and with no "uiAccess" appears like this.

  <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
   <assemblyIdentity type="win32" processorArchitecture="*" version="1.0.0.0"
   name="MyApplication.exe"></assemblyIdentity>
   <description>Vista Application</description>
   <dependency>
    <dependentAssembly>
     <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls"
     version="6.0.0.0" language="*" processorArchitecture="*"
     publicKeyToken="6595b64144ccf1df"></assemblyIdentity>
    </dependentAssembly>
   </dependency>
   <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
     <requestedPrivileges>
       <requestedExecutionLevel level="requireAdministrator"
       uiAccess="FALSE"></requestedExecutionLevel>
     </requestedPrivileges>
    </security>
   </trustInfo>
</assembly>

VistaUACMaker in Action

VistaUACMaker has both console and GUI version. Here is the screenshot of the GUI version

Using VistaUACMaker GUI version

In just 3 steps, your application will be ready to run on Vista.

1. Select the application using browse button.
2. Set one of the privilege required for your application from selection box.
3. Check the "Yes" button if your application interacts with high privilege applications.

Once you have made the settings, click on "Make It" button. Now your application will automatically run as per the privilege set rather than usual "standard user" account.

Using VistaUACMaker Console version

Console tool makes it easy to automate the process. For example you can use it as post build step to make the application Vista UAC compliant. Here is the typical usage information.

VistaUACMakerConsole [-d <description>] [-p <priv level>] [-ui] {exe_path}

Options:
   -d Description of the project ( Default : My project )
   -p Privilege level required. possible values : admin, invoker, highest
       admin = administrator
       invoker = same as parent process
       highest = Highest possible level for the user
   -ui Specify if the executable interacts with higher windows.
       (Default action is not to set this flag)

Example:
    VistaUACMakerConsole -d "Vista project" -p admin "c:\project.exe"

Download VistaUACMaker

VistaUACMaker GUI version 1.3 Windows

VistaUACMakerConsole version 1.0 Windows