Jaa

Using Manifests to Elevate an application in Vista

  • Artikkeli

Problem and the Solution 

Problem: An application we are developing needs to always ask for Admin elevation (even for standard users) to run properly. If the users are standard users, then we need to have the UAC popup with the standard edits to ask for Admin Username and Password. If the user is already an admin and has UAC enabled, it needs to ask for permission to run.

Solution: Once we have your application developed (say MyApp.exe), we need to write a manifest file and either embed that onto the MyApp.exe or include it along with the application to make sure that the application, on Vista, always prompts the user for Admin credentials.

A simple Manifest will look something like this:

<?

xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>

Ways of the Manifest 

Now, as I said there are two ways in which this manifest can be used:

  1. Shipping the manifest file along with the application
    The manifest can be placed along-side the application in the folder in which the application exists by naming the manifest as MyApp.exe.manifest. Vista will automatically apply the manifest file if it doesn't find one embedded in the application. This is one of the ways in which an application can be made forward compatible; by releasing a patch which will just ship-in the manifest file and place it at the location where the application resides.
     
  2. Embedding the manifest IN the application
    We can also embed the manifest file in the .exe file itself by executing the mt.exe tool provided as part of the Visual Studio 2005 SDK.The following steps need to be performed in sequence:
    1. Open up the command prompt (in elevated mode, if using Vista)
    2. Traverse to the directory which contains your MyApp.exe
    3. Make sure that the MyApp.exe.manifest is placed in the same directory (It easily if you do so, once the mt.exe completes successfully, you can remove it from the folder)
    4. Run this command:
      C:\Program Files\Microsoft Visual Studio 8\SDK\v2.0\Bin\mt.exe" -manifest "MyApp.exe.manifest" -outputresource:"MyApp.exe";#1
      (including the #1, which specifies that the outputresource is an executable and not a library DLL. If you want to do this for a library DLL, replace the #1 with #2)
    5. Make sure that there are no errors thrown.
    6. Thats it!!

Preference 

I guess now the question is "Which is preferable?" . My typical answer is "It depends" . It depends on the targetted audience for the application.

  • Layman Users:
    The preferable way will be to embed the manifest onto the application as this involves the least risk. Least risk of confusing the users and least risk of the users trying to tamper the applications behavior by getting hold of valid values for Manifest.
      
  • Technical / Admin Users:
    The preferable way will be to ship along the Manifest so that the users know what they are getting into and have the power to control the elevation. In case the application needs only some privileges which can be configured by the admin of the system onto a different group and adding the user to the group, this will be a better solution rather than always asking for the Admin Elevation.

References:

Comments