Run as administrator and admin group

Question

I have a C # application that should allow the user to change the Computer Name . This is a fairly privileged operation. I can make it work only if the user starts the application as an administrator (Windows 7, right-click the executable file, "Run as administrator"). Great, but the user is the administrator, so why do they need to run the administrator AS ? I have tried this several times. It always fails if the user - the administrator - tries to do this by starting the application in normal mode. It always works if they run it as "Run as administrator".

If the answer is: “It works that way, you have to run as an administrator, even if you are an administrator”, my question is how can I determine if they work with super-duper privileges? I found this one , but it just checks if the user is part of the Administrator user group that I have already indicated is not enough (and throws a null pointer exception).

Am I missing something? Do I need to approach from a different angle?

Answer 1

This is because of user account management (UAC). Introduced in Vista, this changes the way user accounts work.

When a user from the group of administrators logs on to the system, two tokens are assigned to the user: a token with all privileges and a token with reduced privileges. When this user creates a new process, the process by default passed the reduced privilege token. So, although the user has administrator rights, she does not use them by default. This is a good thing".

To exercise these rights, the user must begin the process with elevated rights. For example, using the verb "Run as administrator". When she does this, the full token is transferred to the new process, and the full range of rights can be realized.

You almost certainly don't want to determine if your process is running elevated. Best practice is to mark the parts of your program that require upgrading and make the system display UAC level dialogs when these parts of the program are executed.

Binding is that elevation can only happen when the process starts. Therefore, if you need to divide your application into parts that require upgrading, and parts that do not, you must have several processes. Despite the fact that you can mark the entire application as requiring a promotion, you should not do this if the only thing that requires a promotion is a very rare scenario in which you need to change the computer name.

The next step is to view the details on MSDN. For instance:

• http://msdn.microsoft.com/en-us/library/windows/desktop/bb756996.aspx
• http://msdn.microsoft.com/en-us/library/windows/desktop/aa511445.aspx