Security Problems in Vista - Windows Installer

[mstier]

OS: Windows Vista
TC Version: 7.01

"Acces Denied Error" when executing a setup from within TC.

Steps:
- Start TC as Adminstrator
- Execute a setup program to install a new software ( i wanted to install instep-coreprocesspersonaledition-setup.exe which can be downloaded from w-w-w-dot-microtool-dot-de (sorry, not allowed to post links))
- Access denied error when files are to be copied

Usually setup programms require a confirmation when executed, which is somehow skipped, when exectuted from within TC. However the security context does not provide sufficient rights.

If TC is started as User, the confirmation dialog pops up and the installation performs as expected.

Regards
M. Stier

[ghisler(Author)]

I have downloaded the file. It does not contain the necessary MANIFEST resource which would instruct Vista to run the program with full admin rights.

Therefore you will need to right click on the file (for 1 second) and choose "Run as administrator" to run it with full admin rights. Please note that this is necessary even when you are logged on as user "Administrator", because this user does NOT have full admin rights!

[mstier]

The problem occured when I started TC with the "Run as administrator" option.
I thought any process spawn form TC running as administrator would inherit these admin rights, isn't it?

Therefore I assumed the setup program has had administrative rights.

[sqa_wizard]

I thought any process spawn form TC running as administrator would inherit these admin rights, isn't it?

True for all OS ... but Vista

This is the Vista security feature : Each process is started as "Normal User=Non Admin", nothing inherited ... unless it is elevated by explicit permission.

This way an Explorer or InternetExplorer started as admin cannot be used as "admin-slave" to start virus/trojan processes.

You see: the idea is smart ! (But don't ask what I do call the final implementation ...)

[mstier]

Then one question remains:

If I start the setup in question from within TC as normal User, the Vista "User Account Control" diaog pops up, allowing me to give the setup the requred permission.
If I start it from a TC running as administrator, there is no dialog poping up and the setup fails because of insufficient rights.

Why is there no UAC dialog, if the spawned process has normal user privileges even when TC is in admin mode?

[ricobautsch]

I thought any process spawn form TC running as administrator would inherit these admin rights, isn't it?

True also for Vista. Your thoughts are right.
Each process started from another process with Admin-Token, inherits this elevation.
The author of this thread wrote, that he gets the UAC-dialog, if he starts his setup from TC without Admin-Token.
If he starts from TC elevated, he does not get this UAC-dialog, because his setup inherits the elevation.

Vista requires elevation for the file, even if there is no manifest in the exe. This is the mechanism of vista called "Installer-detection". If there is "setup", "install", and may be other words in the filename, then starting requires elevation. Installer-detection only applies to applications without manifest.

[ghisler(Author)]

Hmm, I don't see what it shouldn't work. When a program is started elevated, then all programs started from that program are run elevated too! Therefore I don't understand why it doesn't work for you. Maybe a Vista bug...

[ricobautsch]

Another security mechanism new in Vista is the mandatory "Integrity Level". It can be "Low", "Medium", "High", "System". Each object (process, thread, file, registry item) has assigned an integrity level.
Maybe your setup accesses objects with level "System", while the elevated TC has level "High". Vista denies access to higher level objects.

On the other hand, if this is a reason, then your setup should also fail, if started from TC running as user.

I had similar problems some time ago. I also had some problems, which i could solve only by login as Administrator (the account, which is disabled by default). This account is always elevated (no UAC dialogs, etc).

Maybe there are really some bugs in the new security architecture of Vista.