The answer to your question: No, you cannot do this.
Microsoft specifically prohibits this behavior. If applications can add themselves to the exclusion list, we are back in the mess we had before.
What you need to do is make your program not requiring administrative access.
Ask yourself: What did you do in Windows XP?
- Am I not allowed to run your software?
- Does your software crash when I'm a standard user?
- Does your software have no meaning and absolutely no functionality when launched by a standard user?
Windows XP lacks confidence in UAC. The only way for a user to run your program as an administrator is to log in with another user. And this is much worse than clicking the Continue button.
If you do not want to write software that is standard for the user, then you are part of the problem. UAC is not a problem; UAC is a belief. I can disable UAC, work as a standard user full time, and your software will not work yet .
Microsoft reviewed
- white sheets
- Remember my preferences
- Do not ask me again.
If you have a white list, then each program will simply add itself to such a list during installation.
If such a whitelist exists, your application will become a target for malware. He would like to modify the binary to accomplish what he wants; as he knows that the program will be quietly raised.
Malicious programs would like to refer to your application using SendMessage, trying to pass invalid data or structures, trying to force your, administrative application to execute the code that it wants.
If the user had the opportunity to disable future tooltips for the programs, they just do it, and each program will work as an administrator, and we will return to how it was.
All these ideas do not solve the problem: almost no program requires administrative access .
It's time to get developers to come to terms with this fact.
Whitelists cannot work
Some people want to come up with ways to work with whitelists.
You have a checkbox where the user can say: "Don't ask me for this file anymore"
If you save this file name, other programs with the same name will quietly work as administrators.
Well, then we write the full path or use the hash of the file as a whitelist. If there is a white list, then other programs will add themselves to this list when they are installed and will have programs with administrative access that the user did not want.
What to do if only signed applications are allowed and we know that they are safe. Applications are not safe because they are signed. The application does not have to be malware so that it can be abused by doing bad things. (for example, buffer overflow in flash, firefox, i.e. chrome, safari, opera, word, photoshop, Yahoo image upload tool).
You need to keep the list of valid code signatures in somehwere list. And no matter how you cut it, the presence of any whitelist means that applications will simply add themselves to this list.
- Well, then do not allow them access to the list. Even administrators cannot add items to the list. If even administrators cannot add items to the list, how can a user add items to the list in the first place? You cannot add items to the white list if you are not allowed to add items to the white list!
And how do you manage the whitelist? Suppose a user changes his mind, or dad changes his mind, or IT changes his mind, or a corporation changes his mind, or a software publisher changes his mind: how do you remove items from a list — especially when no one is allowed to change the list.
Summary: Whitelists cannot work .