Wednesday, January 20, 2016

How does RegEdit require admins to elevate, but not standard users?

Some programs, like the Registry Editor and MMC, will require you to elevate if you're logged on as a local admin but will run just fine if you log on as a standard user.

That setting is stored as part of a program's manifest, an XML configuration tree embedded in the executable (usually). The requestedExecutionLevel setting controls the app's elevation behavior.

  • The default (asInvoker) does not require elevation; if you want to run it elevated, you'll need to explicitly do that by choosing the appropriate item from the context menu. Normal stuff like Notepad uses this value.
  • highestAvailable - the value responsible for this phenomenon - requires the best the current user can have.
  • requireAdministrator always requires elevation. System management tools like DiskPart use this.
You can quickly eyeball an executable for a manifest by searching for the string "manifest" in it with a hex editor or even a text editor. The requestedExecutionLevel setting will be shortly after the place you find.

No comments:

Post a Comment