Can we get the UAC prompt to show only once?

Question

Is there a way for an app to present the user with the UAC prompt only once, upon first running. Thereafter, no further prompting.

In other words, I understand that

Answer 1

The answer to your question is: No, you cannot do that.

---

Microsoft specifically is forbidding such behavior. If a applications could add themselves to an exclude list, then we get back into the mess we had before.

What you need to do is make your program not require administrative access.

Ask yourself: What did you do on Windows XP?

• am i not allowed to run your software?
• does your software crash when i'm a standard user?
• does your software provide no value, and have no absolutely no functionality when run by a standard user?

Windows XP doesn't have the convince of the UAC. The only way for a user to run your program as an administrator is to logon with another user. And that's a much worse user experience than clicking "Continue".

If you don't want to write software that is standard user friendly, then you're part of the problem. UAC is not the problem, UAC is a convience. i can turn off UAC, run as a standard user full time, and your software still won't work.

---

Microsoft considered

• white-lists
• Remember my preference
• Don't ask me again.

If you had a white-list, then every program would just add itself to such a list at install time.

If such a white-list existed, then your app would be the target of malware. It would love to modify the binary to execute what it wants; since it knows the program will be silently elevated.

Malware would love to poke at your application with SendMessage, trying to pass invalid data or structures, trying to get your, administrative, application to execute the code it wants.

If the user had the option to disable future prompts on programs, then they would just do it, and every program would run as an administrator, and we'll be back to the way things were.

All those ideas don't solve the problem: almost no program actually requires administrative access.

The time has finally come to force developers to come to terms with that fact.

---

Whitelists cannot work

Some people want to come up with ways to make whitelists work.

• Have a checkbox where the user can say, "Don't prompt me for this file anymore"
  If you store that filename, then other programs with the same name will silently run as administrators.

• Okay, then we'll record the full path, or use the hash of the file, as the whitelist entry. If there's a whitelist then other programs will add themselves to that list when they install, and have programs running with administrative access that the user didn't want.

• What if only signed applications are allowed, that way we know they're safe. Applications are not safe because they're signed. An application doesn't have to be malware for it to be abused into doing bad things. (e.g. buffer overruns in flash, firefox, ie, chrome, safari, opera, word, photoshop, Yahoo image uploader tool).

You have to store list of valid code-signers in a list somehwere. And no matter how you slice it, having any white-list will mean that applications will just add themselves to that list.

• Well, then don't allow them access to the list. Not even administrators are allowed to add items to the list. If not even administrators can add items to the list, then how can the user add items to the list in the first place? You can't add items to the whitelist if you're not allowed to add items to the whitelist!

And how do you manage the white-list? Lets say the user has changed their mind, or Dad has changed his mind, or IT has changed its mind, or corporate has changed its mind, or the software publisher changes their mind: how do you remove items from the list - especially when nobody is allowd to modify the list.

Summary: White lists cannot work.

Answer 2

If this is possible (I dont think it is considering say How to configure Visual Studio not to give UAC prompt on each run?), I'm pretty sure it has to be done on the users side (like disabling the prompt in the first place), rather than the application side.

Answer 3

The only way is to install yourself as a service or device driver.

Answer 4

This may be of help:

http://www.tipandtrick.net/2008/bypass-or-disable-uac-for-selected-excluded-programs-only-with-elevator-skipuac/

Answer 5

The user should be able to right-click on the executable and go to properties -> compatibility -> "run this program as administrator’"

Answer 6

Developers need a slap in the back of the head do they???

I have created 2 backup programs.

Both require Admin Rights to run.... why? So the user can backup there files where ever they are of course..

Could i run this as a service in the background? mabye? Probably not.

This is the reason that all AV software for instance has services in the background. So the GUI is just the GUI that is it... has no functionallity except to pass the command/info back to the service at which point the commands etc get run.

Wether or not whitelists would work depends on the users... I know users who for a fact just click on 'ALLOW' all the time... they dont even read it. So how is UAC protecting them, remarks like there stupid etc dont help. They do this because UAC prompts them everytime they go to do something.

Backup Programs, Launching apps, Compilers, generators ALL these things for example need admin rights.

Quite frankly a service is not always the answer as it is time consuming to implement and you can't be sure that it gets removed/restarted (auto updating) when it needs to be.