I was trying to portableize a program that made registry entries in HKLM and HKCU. I was thinking about duplicating the registry section in the launcher to handle both. But it gets a little too complicated. Anyone know how to use NSIS to drop rights for a program? Anyone?
And while I'm at it, does anyone know how system::call works?????
You are here
Registry and the Admin
March 24, 2008 - 11:08am
#1
Registry and the Admin
Visit the Community page
Join our forums
Subscribe to our email newsletter
Subscribe with RSS
Follow us on Facebook
Follow us on LinkedIn
Follow us on Twitter
Follow us on Mastodon
Follow us on BlueSky
Try this maybe, works on 2000, XP, Vista (but why really?) -
http://nsis.sourceforge.net/UAC_plug-in
And I know how to use the System plugin a bit. What do you need to do?
as a limited user so I don't have to rewrite code.
Oh, the UAC plug-in only works in Vista because the stupid feature comes out in Vista.
Insert original signature here with Greasemonkey Script.
The page says the plugin works in Win 2000+, and can be used to run a script at user level instead of admin. Read all the way to the bottom, the name is a little misleading...
thanks
*Edit*Darn, there's no execwait function with it :(.
Insert original signature here with Greasemonkey Script.
You could do a two launcher system, with the UAC plugin enabled launcher executing the other one...but this gets messy.
And to be honest, I'm not sure how things will work in XP (or Vista with UAC turned off)...I have a feeling both launchers will have admin rights if launched under an admin account.
It'll probably just be easier for you to deal with both sets of keys manually
Look up DropMyRights or psexec.exe to see examples of programs that can drop the security tokens representing Admin privileges.
I've been using them on XP (for testing as well as general security) and find it works just fine. If an app is running with limited privilege, and it launches an app, that app will inherit the limited privileges (usually). There are times when something comes up that is hard to figure out (like saving an editor configuration file to the "C:\Program Files" location of the editor fails with an odd error) so it probably isn't a great idea to drop privileges without letting the user know, or if the program can spawn a shell or other programs that behave differently when not admin.
MC
DMR could be used for some quick testing purposes but a "true" test needs to be run often as a "true" limited user.
Tim
Things have got to get better, they can't get worse, or can they?
A little late, but what about this plugin?
http://nsis.sourceforge.net/SAFER_plug-in
It uses the SAFER API to create a process with limited rights...