requestedExecutionLevel requireAdministrator doesn't work as expected

Question

I have an app.manifest file as following:

<?xml version="1.0" encoding="utf-8"?>
<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app" />
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
       <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
          <requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
       </requestedPrivileges>
    </security>
  </trustInfo>
  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
    <application>      
    </application>
  </compatibility>  
</asmv1:assembly>

I expect that only an administrator will be able to launch the executable, but it doesn't work that way. Pretty much any user is able to launch it. What could be wrong with my app? Where should I look for a mistake?

Thanks in advance.

Yes, Windows is helpful when you know the name and password of an administrator. Perhaps you know too much for your own good? — Hans Passant, Apr 15 '14 at 10:54

score 1 · Accepted Answer · answered Apr 15 '14 at 10:00

1

I suppose, that users, who can launch this application have disabled UAC. It this case it's possible to launch application, but it will fail. Step 6: Create and Embed an Application Manifest (UAC) (table: Application launch behavior for a standard user account)

answered Apr 15 '14 at 10:00

Vadim

471
6
15

That was the case. User Access Control was disabled. Thanks! PS to solve the problem I've recompiled the app for like 25 times with different settings, while the actual problem was in totally another dimension. =) – dmigo Apr 15 '14 at 11:46

score 0 · Answer 2 · answered Apr 15 '14 at 09:51

0

requireAdministrator requires admin rights for the application, not the "Administrator" account to launch it. In the case, you might want to edit security options and properties, allowing only specified windows account to start the file.

So it seems all your "other" users are in Administrators group.

answered Apr 15 '14 at 09:51

AgentFire

8,944
8
43
90

The account that I use for the check is a member of the Users group only. – dmigo Apr 15 '14 at 10:14

requestedExecutionLevel requireAdministrator doesn't work as expected

2 Answers2