James Finnigan : Tips

The best way to make UAC shut up for a while

jamesfinnigan — Sat, 09 Jun 2007 06:25:00 GMT

Let's say you want to install a few things and want UAC to stop bugging you while you install them. Should you turn off UAC and install the apps? Since that disables UAC's virtualization, it can destabilize things that depend on data written to those virtual locations. Here's an alternative that keeps all the virtualization intact while getting UAC to lay off for a while.

Fire up gpedit.msc and adjust this policy (pictured below):

Change it to be Elevate without prompting:

Of course, remember to turn it back when you're done! :)

Cheers,

James

[Update: how to do this without using gpedit.msc]

Run this command (from an elevated command prompt) to make UAC elevate without prompting:

reg ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f

When you're done, run this command (from an elevated command prompt) to set it back to the default:

reg ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 2 /f

Making an MSI that doesn't need a UAC/LUA prompt

jamesfinnigan — Thu, 03 May 2007 08:03:00 GMT

The goal

I think that most things don't need to require a UAC prompt to install - just install it for that user. Why not make the MSI so it doesn't prompt and your users get a smoother experience? (Also, I feel much better installing a program that doesn't require elevation to install - at a minimum I know it's not disabling my anti-malware software.) Ideally, with that same package you could optionally install per-machine (which requires elevation). Here's some information on how to make it happen...

Background

I was recently asked to make an MSI for an extremely minimal replacement of the Run As menu item that was removed in Vista (by calling runas.exe). Although I doubt we would ever ship something like that I decided to make an installation that didn't elevate, or that could elevate and install per-machine. It was an interesting experience, although I didn't entirely get the behavior I was going for - there are some limitations that make it impossible to do with a MSI in Windows Vista, but still possible in a single download. (More on that later).

The technical details

All MSIs elevate on Windows Vista by default. However there is a flag that you can set that will tell MSI that you don't need to elevate. The 3rd bit of the word count summary property can be set by using the msiinfo tool (comes with the platform SDK). Since I also used an embedded cab, that means my word count summary property should be set to 10 (8 | 2 == 10).

msiinfo RunAsNewUser.msi -w 10

You need to have the feature include both the per-user and per-machine information if you're trying to put both in one package like I did (not a best practice - more on that later).

    <Feature Id='RunAsNewUser' Title='Run as New User' Level='1'>
      <ComponentRef Id='pm.runasnewuser.cmd' />
      <ComponentRef Id='pm.runasnewuser.reg.exe' />
      <ComponentRef Id='pm.runasnewuser.reg.msc' />
      <ComponentRef Id='pu.runasnewuser.cmd' />
      <ComponentRef Id='pu.runasnewuser.reg.exe' />
      <ComponentRef Id='pu.runasnewuser.reg.msc' />
    </Feature>

Your standard MSI that installs to the system directories doesn't face the (fairly simple) issues involved. Here's the per-machine version of my components (you need two versions of the components in order to put them in different directories(*). [I build all my MSIs using Wix - it gives me fine-grained control for making really solid MSIs and it tends to match the way I want to think about MSIs.]

      <!-- We need a per-machine version as well, with seperate components -->
      <Directory Id='ProgramFilesFolder' Name='AdTools'>
        <Directory Id='pm.Microsoft' Name='Microsoft'>
          <Directory Id='pm.Runas' Name='RunAs'>
            <Component Id='pm.runasnewuser.cmd' Guid='9D448C8B-AF67-423B-9622-D9720770B61E'>
              <File Id='pm.runasnewuser.cmd' Name='runasnewuser.cmd' DiskId='1' Source='runasnewuser.cmd' KeyPath='yes' />
              <Condition>ALLUSERS</Condition>
            </Component>
            <Component Id='pm.runasnewuser.reg.exe' Guid='98A7DE3E-EF1D-434F-80CB-2F878CD0E9F5'>
              <RegistryKey Id='pm.runasnewuser.reg.exe' Key='SystemFileAssociations\.exe\shell\Run as new user...\command' Root='HKCR' Action='createAndRemoveOnUninstall'>
                <RegistryValue Id='pm.runasnewuserCommand.exe' Type='expandable' Value='"[#pm.runasnewuser.cmd]" "%1" %*' KeyPath='yes'/>
              </RegistryKey>
              <Condition>ALLUSERS</Condition>
            </Component>
            <Component Id='pm.runasnewuser.reg.msc' Guid='20D758CC-2774-4532-BD6D-E7C378761C90'>
              <RegistryKey Id='pm.runasnewuser.reg.msc' Key='SystemFileAssociations\.msc\shell\Run as new user...\command' Root='HKCR' Action='createAndRemoveOnUninstall'>
                <RegistryValue Id='pm.runasnewuserCommand.msc' Type='expandable' Value='"[#pm.runasnewuser.cmd]" "%1" %*' KeyPath='yes'/>
              </RegistryKey>
              <Condition>ALLUSERS</Condition>
            </Component>
          </Directory>
        </Directory>
      </Directory>

Notice that I made these components conditional on ALLUSERS. We'll make the per-user version conditional on NOT (ALLUSERS). This is pretty basic stuff, and is more or less simply specifying what goes where without much specialized stuff. You can do a per-user setup that looks quite similar by putting it somewhere that isn't off the user's profile. I decided to put mine in the user's profile which means a little extra baggage.

So we're basically done right? Well, not really, no. We've disabled the elevation, but now you need to make your installation not require elevation. Things like installing to Program Files require admin rights, so we'll need to install to somewhere else. I'm not really sure where that should be - probably %UserProfile%\ProgramFiles or something like that. In this example, I installed to LocalAppData.

      <Directory Id='LocalAppDataFolder' Name='AdTools'>
        <Directory Id='pu.Microsoft' Name='Microsoft'>
          <Directory Id='pu.Runas' Name='RunAs'>
            <Component Id='pu.runasnewuser.cmd' Guid='06A57A74-7639-4A96-A1FF-6C434ED50CEF'>
              <File Id='pu.runasnewuser.cmd' Name='runasnewuser.cmd' DiskId='1' Source='runasnewuser.cmd' />
              <RegistryValue Id='pu.runasnewuser.cmd.keypath' Root='HKCU' Key='Software\Microsoft\RunAs\KeyPaths' Type='string' Value='RunAsNewUser.cmd' KeyPath='yes' />
              <RemoveFolder Id='pu.Runas' Directory='pu.Runas' On='uninstall'/>
              <RemoveFolder Id='pu.Microsoft' Directory='pu.Microsoft' On='uninstall'/>
              <Condition>NOT (ALLUSERS)</Condition>
            </Component>
            <Component Id='pu.runasnewuser.reg.exe' Guid='C0DB0776-441A-4AB9-871A-5AF1F326FA0A'>
              <RegistryKey Id='pu.runasnewuser.reg.exe' Key='SystemFileAssociations\.exe\shell\Run as new user...\command' Root='HKCR' Action='createAndRemoveOnUninstall'>
                <RegistryValue Id='pu.runasnewuserCommand.exe' Type='expandable' Value='"[#pu.runasnewuser.cmd]" "%1" %*' />
              </RegistryKey>
              <RegistryValue Id='pu.runasnewuser.reg.keypath' Root='HKCU' Key='Software\Microsoft\RunAs\KeyPaths' Type='string' Value='RunAsNewUser.reg' KeyPath='yes' />
              <Condition>NOT (ALLUSERS)</Condition>
            </Component>
            <Component Id='pu.runasnewuser.reg.msc' Guid='C5B94A3B-7D87-4FC0-AC28-111B86679251'>
              <RegistryKey Id='pu.runasnewuser.reg.msc' Key='SystemFileAssociations\.msc\shell\Run as new user...\command' Root='HKCR' Action='createAndRemoveOnUninstall'>
                <RegistryValue Id='pu.runasnewuserCommand.msc' Type='expandable' Value='"[#pu.runasnewuser.cmd]" "%1" %*' />
              </RegistryKey>
              <RegistryValue Id='pu.runasnewuser.reg.msc.keypath' Root='HKCU' Key='Software\Microsoft\RunAs\KeyPaths' Type='string' Value='RunAsNewUser.reg.msc' KeyPath='yes' />
              <Condition>NOT (ALLUSERS)</Condition>
            </Component>
          </Directory>
        </Directory>
      </Directory>

The extra baggage is the HKCU keypath RegistryValue, and the RemoveFolder entries. Nothing crazy, but a little extra to be aware of. These are necessary because of things like roaming profiles.

The experience

You can install it and it goes through without any elevation. The installation is per-user by default. (Yay! Per-user works and has a smokin' experience, and supports all kinds of scenarios.)

If you want to install it per-machine, you need to launch it via this command:

msiexec /i RunAsNewUser.msi ALLUSERS=1

This is obviously not ideal - but there's a hidden hiccup. I thought that it would prompt for elevation if you specified ALLUSERS=1 - it does not. You get this error message:

It's not the end of the world. If you run the same command from an already elevated process (e.g. an elevated command prompt) the installation goes through just fine (as the error message implies). It's a bit of a shame, but I've confirmed with Carolyn that you can't build a single package that will elevate sometimes and sometimes not (because the flag is in the MSI summary information it can't be changed in-flight).

The best practice for building a per-user (without elevation) and per-machine app (with elevation)

Because of the limitations noted above, here's what is the best practice for building a per-user and per-machine app: Have a bootstrapper exe, and two separate MSIs (one per-user package and one per-machine package). If these are embedded in the bootstrapper exe as resources that are extracted at install, then you can a single download that installs either as per-machine or per-user.

Why? Well, not many folks are trying to do this at the moment. Of course, more will as Vista is on more and more computers - ultimately I think this is a huge step forward for keeping your computer free of malware. I think it's worth saying twice: I feel much better installing a program that doesn't require elevation to install - at a minimum I know it's not disabling my anti-malware software.

Other Resources

http://blogs.msdn.com/windows_installer_team/ - Get it straight from the horse's mouth

http://blogs.msdn.com/astebner/archive/2006/12/13/some-useful-things-i-have-learned-about-windows-installer-and-uac.aspx - Good intro article that doesn't bury you in information like Roberts' (great) blog entries

http://blogs.msdn.com/rflaming/archive/2006/10/01/uac-in-msi-notes-answers-to-questions-in-comments-from-earlier-blog-posts.aspx - Summary of Robert's huge series about MSI and UAC

http://blogs.msdn.com/rflaming/archive/2006/09/30/778690.aspx - Robert gives his take on the question: Should I write my installer as a Standard User install? If yes, how?

* I imagine that you don't really need two versions of the components because I imagine that you could change the directory location using a custom action that set it, but I just found things a lot simpler if I used two different components

How to launch an un-elevated process from an elevated process

jamesfinnigan — Thu, 12 Apr 2007 07:11:03 GMT

This question has come up a fair amount lately. The short answer is that you don't* - instead you should:

first launch an unelevated process
have that unelevated process launch an elevated process and wait for it to finish (or use some form of IPC)
have that unelevated process then do what you wanted the elevated process to un-elevate and do

OK, but why? When you elevated there's a good chance that you also changed users. If you simply had a way to generate the split token associated with the elevated user, then you would be running as the wrong user.

This is all documented, of course, in the Windows Vista Application Development Requirements for User Account Control Compatibility document (I hate sentence names).

* Caveat: There is still a way to launch a process as that original user with the split token - use task scheduler (see the linked document for the source code). I don't recommend using task scheduler (I recommend the process above), but there are times when your choices are limited.

Windows Live ID Client SDK alpha release

jamesfinnigan — Fri, 02 Feb 2007 10:20:54 GMT

On a recent post about BITSAdmin, someone commented on how you needed to be logged into passport to download certain things. Well I noticed in Brian's blog that there is now an alpha release of the live client SDK. I haven't tried it out (still busy recruiting in Utah), but it looks promising that this will allow you to login via passport and then kick off bitsadmin to download those items.

Please provide feedback to help improve the SDK!

Thanks,
James

RE: How to get rid of that pesky Windows Welcome Center at FIRST boot

jamesfinnigan — Thu, 25 Jan 2007 10:13:00 GMT

While reading blog comments about Welcome Center, I came across this entry on how to remove welcome center at first boot.

...

With a simple .reg file though, you can kill Windows Welcome Center dead on first boot — simply put the following into your .reg file and save it, run it, or add it to your scripts:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"=-

...

That will do it. But if you run this command instead, you can avoid creating a file and the elevation prompt.

reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsWelcomeCenter /f

Oh, and sorry about waiting until the second time you see it before displaying the checkbox - that wasn't my idea. (Welcome Center was a feature with a lot of input.)

Using WMIC to check for predicted disk failure (S.M.A.R.T. analysis)

jamesfinnigan — Tue, 16 Jan 2007 01:41:22 GMT

I was looking at the Windows Vista Reliability and Performance Monitor and noticed that the data collector sets for System Diagnostics included a SMART disk check. I've been waiting for Windows to make better use of SMART and hadn't noticed that there was a WMI entry for it. I took a look at it in WMIC to see what data was there. You can also view the data and thresholds used to predict failure, etc.

WMIC /NAMESPACE:\\root\wmi PATH MSStorageDriver_FailurePredictStatus
Active InstanceName PredictFailure Reason
TRUE IDE\DiskWDC_WD1200BB-00CAA0_____________________16.06V16\5&134a4e1&0&1.0.0_0 FALSE 0
TRUE IDE\DiskWDC_WD740GD-00FLA1______________________27.08D27\5&14d2dd2b&0&0.0.0_0 FALSE 0
TRUE IDE\DiskST3250823AS_____________________________3.03____\5&278c8dd0&0&1.0.0_0 FALSE 0

WMIC /NAMESPACE:\\root\wmi PATH MSStorageDriver_FailurePredictData
WMIC /NAMESPACE:\\root\wmi PATH MSStorageDriver_FailurePredictThresholds

How to use BITS to transfer files

jamesfinnigan — Sat, 23 Dec 2006 13:57:55 GMT

BITS is Microsoft's background intelligent transfer service. It's used to transfer files without it bothering you (roughly). The goal is to use idle bandwidth, so it doesn't affect that streaming radio station that you like, your video chat, etc.

The service is relatively full-featured, although there isn't a proper UI that I'm aware of (not sure why this wasn't baked into IE7). I've usually whipped up a simple .net app to do this kind of thing (large files, bad connections), but it initially didn't handle proxies that well and was never great and didn't do the idle-bandwidth thing. Enter BITSAdmin.

BITSAdmin is a simple command-line tool shipping with Vista, and available as a download for XP and above.

Here's a sample of how to download XNA Game Studio Express 1.0:

BITSAdmin /transfer xnase http://www.microsoft.com/downloads/info.aspx?u=http%3a%2f%2fdownload.microsoft.com%2fdownload%2f9%2f0%2fb%2f90b2097b-cb79-40fd-9d00-0917afc039e1%2fxnagse_setup.msi xnase.msi

Here's another example of the same thing via tinyurl (it can help avoiding a lot of escaping of ampersands):

bitsadmin /transfer xnase http://tinyurl.com/yhmojh xnase.msi

This does it right away and lets you watch it. If you don't want that console window hanging around, or want to do several at once you can use this alternate syntax (bitsadmin /? shows the help but it's overly verbose and lacking decent simple examples before it launches into the 200 lines of help).

bitsadmin /CREATE /DOWNLOAD xnase

bitsadmin /ADDFILE xnase http://tinyurl.com/yhmojh xnase.msi

bitsadmin /ADDFILE xnase http://example.com/example.zip ex.zip

...

bitsadmin /RESUME xnase

bitsadmin /MONITOR (till it's done)

bitsadmin /COMPLETE xnase

You can adjust it's priority, set notifications, peer caching, etc, etc, etc.

Photo Album Publishing - Why print photos when you can print a book?

jamesfinnigan — Fri, 01 Dec 2006 09:02:00 GMT

Did you know that you can print custom books now? I can easily and cheaply create my own book with mypublisher. It's no quark (what most real publishers use), but it's cheap, easy and good enough. For what I want to do, it looks like the right level of flexibility. I love products like mypublisher and Windows DVD Maker that give me a professional look without too much trouble so I can share great memories, without giving up my life.

I was just in the process of putting together some interesting photo stuff when this caught my eye. I don't have any immediate plans to do something with it, but this seems like a great and inexpensive way to capture some great moments like our vacation to Europe in a way that doesn't involve a computer screen and that we can send to Grandparents and other folks who'd rather not have to sit at a computer to enjoy pictures of those that they love.

I really love the picture screensavers myself, but this is probably something that I'll use to put together a few photo albums of our own. We may even print off the blog that we share with our family members in book format.

Christmas Camera Shopping Technique and Recommendation

jamesfinnigan — Mon, 27 Nov 2006 07:59:13 GMT

I've been thinking about good point and click cameras lately, and I'm a big fan of the Ricoh Caplio R4. I've played with it myself, and enjoyed some great pictures of flowers from it. But I was recently looking at a report of the most popular cameras on flickr, and noticed that you could see pictures taken with the different cameras.

Because Flickr supports searching pictures taken by a particular camera, you can (as in the flowers link above) search for pictures of flowers taken by your camera. I recommend checking a few common scenarios like longexposure, indoor, etc and compare them with a nice DSLR (I currently use a Canon Rebel XT although I really need more lenses (hint, hint family :)) - longexposure, indoor).

Windows Vista Keyboard Shortcuts

jamesfinnigan — Sat, 25 Nov 2006 07:02:36 GMT

Just came across this good listing of keyboard shortcuts in Windows Vista and thought I'd share them around. Some people refuse to use the keyboard for much besides email, but I'm a huge fan of keyboard shortcuts (and love the ubiquitous search features in Vista)