How to ask for Administrator privileges in Windows ?

vivekmalik2466

i want this to edit file in program file .i can do this if i run application as "run as admin ".
but as other user i cant

ChrisW67

Here are some options:

You embed a UAC manifest that require administrator privileges and run the entire program with elevated privilege (a requestedExecutionLevel of requireAdministrator).
Create a COM component, register is properly, and and create it with CoCreateAsAdmin.
Launch a separate process with the elevation manifest to do the specific task.
Redesign your application so that unprivileged users do not need privileged operations. Start by storing user editable data in correct locations.

All of the is Windows specific and not Qt related.

vivekmalik2466

Thank you Chris.
Can you please explore more with UAC manifest with qt desktop application .how to create and add it to application .

Tannin

QMAKE_LFLAGS += /MANIFESTUAC:"level='requireAdministrator' uiAccess='false'"
should do the trick I think you'd still have to request individual privileges with AdjustTokenPrivileges.

As an alternative, if all you're doing is file operation in protected directories, you could see if SHFileOperation solves your problem. This will pop up the default windows dialog to ask the user for permission when operating on a protected directory. The API is somewhat outdated/broken though.

kuzulis

Hello, guys.

I have a question: whether it is possible to use Manifest file with the compiler MinGW, or this opportunity is available only with MSVC compiler?

ChrisW67

Yes it is possible. In your PRO file:
@
RC_FILE = myapp.rc
@
In the RC file:
@
ID_ICON ICON DISCARDABLE "myapp.ico"
CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "myapp.exe.manifest"
...
@
and the manifest itself:
@<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<assembly manifestVersion="1.0">
<assemblyIdentity version="2.0.0.0" processorArchitecture="X86"
name="com.example.myapp" type="win32" />
<description>MyApp</description>
<dependency />

<trustInfo >
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="requireAdministrator"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
@
You can install an asInvoker level manifest the same way.

esandy

I tried the exact step suggested by ChrisW67 but it doesn't seem to do anything.

I have a application which creates sqlite files under programfile/myapp folder which is automatically getting created in VirtualStore, I understand that by having manifest file myapp will create these files under program files/myapp folder. Am I correct what else do I need to do to achieve this.

So I tried creating manifest files using steps given above but it isnt doing any difference.

Any help will be appreciable. Thanks.

hardcodes.de

Why should an application have a database in c:\program files\appname?

esandy

Thanks for question. I am very new to app dev. This my first app on windows. No idea where I should have my db files. But was thinking that they should instead stay somewhere around my application folder so just created another folder with in the app which holds db files.

Should they reside in diff folder ? which ? and will I still need manifest file for UAC as I want to allow user to copy those file in and out

SGaist

Hi,

If you are using Qt 4 you should put the database in QDesktopServices::DataLocation or for Qt 5 QStandardPaths::DataLocation which are user folder for application specific data

T3STY

Windows applications usually store settings and other not-core files in the AppData\Local folder:
@C:\Users\USERNAME\AppData\Local\COMPANY\APPNAME@
In the Local folder only privileged users have access. If you don't ever need Admin privileges in your application then it's highly suggested to use the low privileges version which changes from Local to LocalLow:
@C:\Users\USERNAME\AppData\LocalLow\COMPANY\APPNAME@
If your application is using some settings or files that are common to other applications, then there is the Roaming folder:
@C:\Users\USERNAME\AppData\Roaming\COMPANY\APPNAME@
The Roaming folder is free-for-all which means you can access it with low privileges as well. But even if your application(s) use some common settings files it's not really necessary to use the Roaming folder; it is a recommended use but not mandatory.

Another option for storing settings was to use the user's Documents folder:
@C:\Users\USERNAME\Documents\APPNAME@
This folder is always user-accessible, so it always grants you the permission to access it and its contents. Beware though that if your application is meant to be multi-user with shared settings you should avoid using the Documents folder as it can only be accessed by Admin and by the owner user (f.e. T3STY\Documents cannot be accessed by user SomeoneElse, and SomeoneElse\Documents cannot be accessed by user T3STY - You Linux guys should already know about these user permissions and how they work).

p.s. Please note that the paths above are for Windows Vista and higher OSs. For XP and previous the AppData folder resides in
@C:\Documents and Settings\USERNAME\ (...)@

esandy

Thanks all. Your information helped me very much.
QStandardPaths::DataLocation returns "Application Data" string even on windows 7 when the the data location folder I believe is "AppData" on win7 as T3STY mentioned.

Shouldn't QT API return back the data location based on the OS like xp, win7, 8 ?

Is it safe to instead hardcode the path to
QDir::homePath() +
/AppData/Local +
QCoreApplication::organizationName + QCoreApplication::applicationName

Isnt their an API which returns path to local folder on windows?

T3STY

The AppData folder is actually in the environment paths. It's like the system32 folder. So, no matter if it returns AppData (relative path) or C:\Users\USERNAME\AppData (full path), it'll always mean the same folder and it will work anyway.

Although, I'm actually unsure whether it works even in user-made paths. Supposing you have a string with a path like:
@mypath = "AppData\Local\Myapp";@
I'm not sure if using this path will actually look just for an AppData folder inside the application folder (where the .exe resides) or also in the environment paths (so, C:\Users.... ect.). You might want to have a try, possibly let us know. Anyway, whichever folder path Qt returns, stay sure it works.

p.s. If you want to know which environment paths are available in Windows check them out by doing:
(right-click) Computer > Properties > Advanced system settings > Advanced (tab) > Environment paths
(please note that I'm using an Italian version of windows, and I tried to translate the strings as good as I could).

amahta

It seems the question here has changed somehow.
I still really need to know "How to ask for Administrator privileges in Windows ?"
I really need it. Any ideas?

T3STY

A good answer has been given in post #1 by ChrisW67.
An explanation of the UAC execution levels is given here:
http://msdn.microsoft.com/en-us/library/windows/desktop/bb756929.aspx
and here:
http://msdn.microsoft.com/en-us/magazine/cc163486.aspx
When marking your application with execution level "require administrator" it will ask for administrator privileges on startup. It is ok if your app is intended for admin-only tasks, but not if admin privileges are only needed for a few stand-alone features (like setting a few keys in the windows registry). In this last case I'd suggest reading further or starting as "highestAvailable" privileges.

Please note that once started an application/process you may not change the execution level of the application/process itself. Instead, you have to kill the application/process and restart it by requesting administrator privileges. There is an MSDN example code (poorly explained) at this link:
http://code.msdn.microsoft.com/windowsdesktop/CSUACSelfElevation-644673d3
The app starts as standard unprivileged user. When the button is clicked the application shows an UAC dialog and asks the user for admin privileges which is the behavior intended for the UAC use in most cases.

Unfortunately I can't help with ready-made code since I didn't work on this, but a few links during searches look like it's pretty much simple...

amahta

Thanks for your comments T3STY

amahta

[quote author="Tannin" date="1367231258"]QMAKE_LFLAGS += /MANIFESTUAC:"level='requireAdministrator' uiAccess='false'"
should do the trick I think you'd still have to request individual privileges with AdjustTokenPrivileges.[/quote]

Seems this is not working with MinGW. Does anyone know how to make this work with MinGW?

antonioborondo

@amahta said:

Seems this is not working with MinGW. Does anyone know how to make this work with MinGW?

Hi @amahta, I have developed a full example of how to grant administrator privileges to a Windows application using MinGW and CMake: http://www.antonioborondo.com/2014/11/25/how-to-grant-administrator-privileges-to-windows-applications/

I am pretty sure that it will help you a lot!