Machine-wide NSIS installer launches application as administrator

[ghost]

• Version: 7.14.2

• Target: Windows

With a machine-wide NSIS installer (a UAC dialog popped when launching), having the "Run $application" checkbox checked, my application runs with administrative privileges; I expected my application to be run with non-elevated privileges.

[develar]

We do use UAC_AsUser_ExecShell https://github.com/electron-userland/electron-builder/blob/master/templates/nsis/boringInstaller.nsh#L9 and it still doesn't help? Or... we use it only in case of boring installer.

[ghost]

Correct. I noticed this when launching an executable with shell.openItem, expecting to see a UAC dialog, but I did not.

Here are screenshots from procexp:

Launching application normally from desktop shortcut

Launching application at end of installer

[ghost]

From the NSIS UAC page, I see the following line in the code example:

RequestExecutionLevel user ; << Required, you cannot use admin!

Perhaps the electron-builder NSIS template is incorrectly requesting administrative privileges via RequestExecutionLevel?

[develar]

No. one click machine wide installer must use admin because it is one click, not boring installer. I will investigate issue.

[develar]

Reproduced (to reproduce, your account should be not administrator).

[develar]

Fixed — StdUtils.ExecShellAsUser must be used. https://github.com/lordmulder/stdutils

[develar]

Thanks for spotting it and clear report.

[ghost]

I just upgraded to 7.18.1, re-built my installer, and I am experiencing the same issue.

[ghost]

My NSIS configuration:

"nsis": {
    "oneClick": false,
    "perMachine": true,
    "guid": "939693fe-aa4b-4da5-b1de-34700e4f1c83"
}

[develar]

I created test user without admin rights and tested — works for me (win 10). Ok — will try to test it again.

[develar]

Ouch, "oneClick": false, — boring installer, not one-click?

[ghost]

boring installer, not one-click?

Correct.

[develar]

Every user of NSIS boring installer should upgrade to next electron-builder version as soon as possible.

[anran800]

I include file 'installer.nsh' .test successful
!macro customInstall
StrCpy $appExe "$INSTDIR${APP_EXECUTABLE_FILENAME}"
WriteRegStr HKCU "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" "$appExe" "RUNASADMIN"
!macroend

[DxCx]

@anran800 thanks for your solution, it helped 👍
just one correction, you are missing '\', so it should be:

!macro customInstall
StrCpy $appExe "$INSTDIR\${APP_EXECUTABLE_FILENAME}"
WriteRegStr HKCU "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" "$appExe" "RUNASADMIN"
!macroend

[DxCx]

for uninstalling the rule when application uninstalls i used:

!macro customUnInstall
DeleteRegValue HKCU "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" "$INSTDIR\${APP_EXECUTABLE_FILENAME}"
!macroend

[develar]

@anran800 Why do you need to do it, what's wrong? This issue was fixed.

[DxCx]

@develar what do you mean fixed?
This marks the installed exe as RunAsAdmin

[develar]

@DxCx So, please do not comment here, but create new issue and request feature :)

[DxCx]

that's not a new issue :)
i got here with google looking for solution and found halfworking one,
just wanted to share my experience with the others who will get here.

[develar]

@DxCx This issue about "installer by mistake runs installed app as admin" ;)

[DxCx]

then you are right @develar , my bad =) i was getting here searching the exact opposite 🤣