windows - Windows如何决定是否显示UAC提示符？

Question

在我的 VB6 应用程序中，我打开其他 EXE 文件。我的应用程序在没有任何 UAC 提示的情况下运行，但我有一个检查软件更新的 EXE。这会提示 UAC 提示符。那么Windows是如何决定是否显示UAC提示的呢？我看到这个 link .那么它是否取决于我在应用程序中编写的代码？有趣的是，我的应用程序(即主 EXE 文件)不提示 UAC，而检查和下载更新的小 EXE 提示 UAC。我对所有 EXE 文件都进行了数字签名。我已经浏览了以下链接:

http://msdn.microsoft.com/en-us/library/windows/desktop/aa511445.aspx

http://technet.microsoft.com/en-us/library/cc505883.aspx和其他一些。

但是我还是不太清楚。

Answer 1

您几乎肯定会遇到 Windows Installer Detection Technology ^🕗 兼容性启发式。Windows 将尝试检测应用程序何时是安装程序，并且可能需要提升。

Installer Detection only applies to:

1. 32 bit executables
2. Applications without a requestedExecutionLevel
3. Interactive processes running as a Standard User with LUA enabled

Before a 32 bit process is created, the following attributes are checked to determine whether it is an installer:

• Filename includes keywords like "install," "setup," "update," etc.
• Keywords in the following Versioning Resource fields: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name.
• Keywords in the side-by-side manifest embedded in the executable.
• Keywords in specific StringTable entries linked in the executable.
• Key attributes in the RC data linked in the executable.
• Targeted sequences of bytes within the executable.

所以，正如你所说:

but i have a exe which checks for updates to software

我的猜测是这个 CheckForUpdates.exe 正在触发兼容性试探法。

正确的做法是将程序集 list 添加到“正在检查”的可执行文件中，通知 Windows 它应该不提升效用。这是通过 list 中 asInvoker 的 requestedExecutionLevel 完成的:

AssemblyManifest.xml:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> 
   <assemblyIdentity 
      version="1.0.0.0"
      processorArchitecture="X86"
      name="ITReasearchAssociates.Contoso.Updater"
      type="win32"
   /> 

   <description>Update checker</description> 

   <!-- Run as standard user. Disable file and registry virtualization -->
   <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
      <security>
         <requestedPrivileges>
            <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
         </requestedPrivileges>
      </security>
   </trustInfo>
</assembly>

这样您的“检查更新”应用程序将永远不会提升，也永远不会错误地获得管理权限。

如果您希望您的更新程序实际应用更新(需要管理权限的更新)，那么您将以管理员身份启动您的更新程序应用程序。

示例代码

//Check if there are updates available
if (!CheckForUpdatesAvailable())
   return; //no updates. We're done

//If the user is an administrator, then get the update
if (IsUserAnAdmin())
{
    //Maybe throw in a "Hey, user, wanna get the update now?" dialog
    DownloadAndApplyUpdates();
    return;
}

//The user is not an admin. 
//Relaunch ourselves as administrator so we can download the update
//Maybe throw in a "Hey, user, wanna get the update now?" dialog. A button with a UAC shield on it
ExecuteAsAdmin(Application.ExecutablePath, "/downloadUpdate");

辅助函数:

private Boolean IsUserAnAdmin()
{
    //Public domain: no attribution required
    //A user can be a member of the Administrator group, and yet not be an administrator.
    //Conversely, the user can be an administrator while not being a member of the administrators group.
    var identity = WindowsIdentity.GetCurrent();
    return (null != identity && new WindowsPrincipal(identity).IsInRole(WindowsBuiltInRole.Administrator));
}

private void ExecuteAsAdmin(string Filename, string Arguments)
{
    //Public domain: no attribution required
    ProcessStartInfo startInfo = new ProcessStartInfo(Filename, Arguments);
    startInfo.Verb = "runas";
    System.Diagnostics.Process.Start(startInfo);
}

然后在启动时，您只需查找 /downloadUpdate 命令行参数即可知道您的工作是实际上做工作:

public Form1()
{
    InitializeComponent();

    //Ideally this would be in program.cs, before the call to Application.Run()
    //But that would require me to refactor code out of the Form file, which is overkill for a demo
    if (FindCmdLineSwitch("downloadUpdate", true))
    {
        DownloadAndApplyUpdates();
        Environment.Exit(0);
    }
}

Note: Any code is released into the public domain. No attribution required.