NSIS: application installation is always performed as administrator

Question

I have an NSIS script that works well for a large application. I read a lot of streams all over the Internet, but I can’t get a clear answer to the following: is it possible to install an application using NSIS, which when launched (regardless of user type) starts automatically as an administrator? If possible, how can this be achieved?

Note. I already point out that the NSIS package should run as admin using

 RequestExecutionLevel admin 

I tried to write the UAC request to write the application registry using this but I could not get the RUNASADMIN command to compile as it is not in the required format for NSIS.

Answer 1

To make sure the installer works as an administrator, I recommend this small example:

 Outfile RequireAdmin.exe RequestExecutionLevel admin ;Require admin rights on NT6+ (When UAC is turned on) !include LogicLib.nsh Function .onInit UserInfo::GetAccountType pop $0 ${If} $0 != "admin" ;Require admin rights on NT4+ MessageBox mb_iconstop "Administrator rights required!" SetErrorLevel 740 ;ERROR_ELEVATION_REQUIRED Quit ${EndIf} FunctionEnd Page InstFile Section SectionEnd 

The installed application should perform similar actions, if it always needs to be run as admin, for the Win32 application, which will:

• Add requestedExecutionLevel element to manifest with level attribute set to requireAdministrator
• Call IsUserAnAdmin or CheckTokenMembership to make sure that you are indeed administrators.

If "automatically starts as administrator" you mean bypassing the UAC upgrade, then no, this is not realistic, the whole UAC point should allow the user to confirm / deny privileged operations! Some applications will do this by installing an NT service that performs any operation they require on behalf of the application. I would not recommend this because it fills the machines with users services and can weaken the security of the system if the service is not encoded correctly.

If you did not specify the application you are installing, your options are a bit limited. If the application does not have a manifest at all, you can use the external ( myapp.exe.manifest ) manifest.

Setting the RUNASADMIN line under the AppCompatFlags key is not something the installer should do; these compatibility parameters should be controlled by the user, not by the applications.

In the forum topic, you also indicated two ways to set the SLDF_RUNAS_USER flag in the shortcut, this does not guarantee that the application starts as an administrator in all situations, only when the application starts from the shortcut, but this may be your only option if you cannot change it yourself attachment...