4

I didnt get correct answer and got lots of answers like "we can not do like this" for my previous questions.

Thats why I decided to explain in detail about my problem please help me if you can or please ask your friend who can answer this.

Now my problem:

Step 1:

I created a C# program which edits various windows registries. For editing windows registries we must have an Admin privilege. My program is running fine in Administrator mode without any problem.

Step 2:

I want my program to be run into limited user mode also. If few people didnt get what I am saying here is that I want to run my above C# code into Guest mode. In guest mode there is a restriction that We can not change Windows Registries. So as I am executing my Application, I am getting one notification which is asking for Admin Password. After inserting Admin Password my application is working fine.

Step 3:

I want that my application must not ask Admin password every time in Guest/limited account. I also want that in Guest mode my Application should work. I also want that in Guest mode my Application should be able to access and change Windows Registries.

Step 4:

Lot of people replied me that we can not do this in Guest mode since Windows is restricting users to edit windows registries for security purpose. So please if you also feel like this then please do not reply to this question. I am answering to those people that, all good antivirus which run into Guest mode has access to Windows Registries.

Step 5:

  1. Since I know Admin Password so is there any way of saving Admin password in our C# code and bypass popup message of asking Admin password again and again.

  2. Is there any way that we will instruct Windows that our application will be running in Admin mode and do not ask for Admin password again and again

  3. How Antivirus application running in Guest mode do all the operation like deleting virus from system32 folder and resetting registries after Virus attack. These antivirus application never asks for "We found a virus in System32 folder, Since I am running in Guest mode and unable to delete virus, so please enter Admin password so that I can delete virus"

I hope you understood what i mean to ask?

I want to develop a C# application which should run in any mode (Admin/Guest/Limited) and should be able to Create, Edit and Delete Windows Registries.

Note: Please do not answer this with "right click and Run As Administrator".

J. Steen
  • 15,470
  • 15
  • 56
  • 63
Rahul Gupta
  • 89
  • 2
  • 9
  • 1
    Antitivus packages run as admin and most of the time install drivers (.sys) as well. – Simon Mourier Aug 09 '11 at 07:09
  • 1
    Just because you (desperately, obviously) want something, doesn't mean it is possible (especially, but surely not limited to step 5, point 1). You should rethink your design. – Christian.K Aug 09 '11 at 07:14
  • what you are looking for is called [impersonation](http://msdn.microsoft.com/en-us/library/w070t6ka.aspx) - edited the link. it is even possible on a code-block-only basis. if you want to store admin passwords though be aware of the security risks and never store it anywhere as plain text, at least use encryption. – mtijn Aug 09 '11 at 07:15
  • @mtijn: yes, but then he is not. He explicitly stated that he doesn't want the "notification" (UAC prompt most likely) and especially not type in the password. AFAIK you can't circumvent the UAC prompt, let alone the password insertion, from code. Futile. – Christian.K Aug 09 '11 at 07:19
  • he says he knows the password.. anyway, [here](http://msdn.microsoft.com/en-us/library/aa378184(VS.85).aspx) is how to logon a user programmatically, this is also used in the link I mentioned earlier about impersonation. – mtijn Aug 09 '11 at 07:27
  • It [appears](http://stackoverflow.com/questions/5098121/how-can-i-get-elevated-permissions-uac-via-impersonation-under-a-non-interactiv) though, that LogonUser will only return a restricted token (for interactive sessions anyway), thus still requires one to acknowledge an UAC prompt AFAICT. – Christian.K Aug 09 '11 at 08:05
  • that's a nice piece of intel.. ok then how about [manually creating the token yourself](http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20Objects/Token/NtCreateToken.html)? it's a big pain though. – mtijn Aug 09 '11 at 09:28

2 Answers2

2

To the best of my knowledge, antivirus software solves this problem by running two (or more) processes: a user interface program running as the guest user, and a privileged process (usually a Windows service). The user program is not able to actually manipulate privilege-restricted resources (like secure registry hives) -- instead, it communicates with the privileged process (hopefully in some secure way) and the privileged process performs the privileged action on behalf of the user.

This is the same kind of technique by which programs ever access privileged resources, such as hardware. Your user-level process doesn't (usually) have the right to perform various hardware actions, like remapping memory in the MMU, but the OS does, and you can get the OS to do what you want by asking it to. System calls thunk into kernel mode, which is fully privileged. However, the system call interface limits the kinds of privileged actions which you can take.

Daniel Pryden
  • 59,486
  • 16
  • 97
  • 135
  • privileged process (usually a Windows service) can not edit registries even in Administrative mode. For editing windows registries our code must be a Process or and Application. If you are saying that using Windows Service we can edit Registries then tell me how? – Rahul Gupta Aug 09 '11 at 08:17
  • do you think processes spawned by the privileged process will be able to modify the registry? if yes, this answer applies even if the privileged process is a windows service because it can spawn another process to modify the registry. – mtijn Aug 09 '11 at 11:32
  • @Rahul: I'm confused. If you're running a Windows service as an administrator user (a real Administrator user like SYSTEM, not just a user with UAC rights) it can indeed attach to local registry hives (e.g. HKLM, HKCR) and modify keys and values. Or are you describing something different? – Daniel Pryden Aug 09 '11 at 18:27
1

I cant help but saying, NO, you cant do admin things under a guest account. And no- you cant programmatically bypass UAC.

Maybe the following 2 workarounds are interresting for you?

I believe antivirus software runs under the System account (can only be installed by an administrator). For your application, you can create a server/client architecture (both running no the same machine) where the server is installed by the administrator (as part of the whole package) and runs by default under the System account. Then you can use the client on the quest account to send commands to the server.

One other solution might be not to use the registry directly but use another underlying datastore which is accessible by a guest account and synchronize that on demand with the registry (startup and shutdown?), so you only need the admin to login once or twice during the run of your app.

Polity
  • 14,734
  • 2
  • 40
  • 40
  • You know what, I am installing my Application using Administrative account but when I go to Guest mode before execution of my application it is asking for Admin privilege. My Question is that you give solution that UAC prompt should not come every time. If you are giving solution that in Admin mode I must install and then program must work then I am doin the same because in Guest mode we can not install any Application. – Rahul Gupta Aug 09 '11 at 08:21
  • @Rahul: There is a big difference between software that is *installed* as an Administrator user and software that is *executing* as an Administrator user. If your program is **launched** by a privilege-reduced user, it will have reduced privileges (and require UAC). The solution is to have your Administrator user install **and launch** the program, and keep it running past when the Administrator user has left. The common way to do this on Windows is by creating a Windows service. – Daniel Pryden Aug 09 '11 at 18:33