Comments on: Your Installation is Complete

By: Dmitry Karzhavin

Dmitry Karzhavin — Mon, 19 Oct 2009 10:24:04 +0000

With regards to my installers, it was due to Inno Setup’s preferences. One needs to take some care to create non-admin installer. It’s not on by default. Still, Inno Setup doesn’t work flawlessly in non-admin mode. I’d like it to copy files into Application Data (instead of Program Files) and create icons in the private Start Menu folder (instead of Common). Inno Setup doesn’t allow such tricks to be easily expressed. I’ve done my best to make my installer non-admin demanding, but it’s indeed easier to download .zip instead of .exe from my website.

Youк claims should be addresed to setup compiler creators IMHO. I have nothing against non-admin installations. It just was off by default.

By: Christian Wimmer

Christian Wimmer — Sat, 21 Mar 2009 11:03:59 +0000

The choice is always made by the programmers. Before Vista, programmers decided that their setup routines needs administrative rights always! Many people didn’t care because they were Administrators by default. However in Vista, many setup would have failed if MS haven’t implemented that files with setup or install in the name are elevated by default (with no manifest).
So the next step of the programmers would be to leave the choice to the users whether they want to install the product in a commonly used place (like Program Files) and thus need elevation or in another place of their choice (but whithout elevation).

By: Craig Stuntz

Craig Stuntz — Fri, 20 Mar 2009 12:32:29 +0000

Sure, you can override what Vista does by default. But don’t completely miss the point: This is a choice that Vista makes, not a choice that the developer made.

By: Christian Wimmer

Christian Wimmer — Fri, 20 Mar 2009 10:01:08 +0000

Nope, I don’t think so.
Try to install this product : http://www.teamviewer.com (Free for private use)
It has an installer that can either start the application or install it (whereever your want). It does not request elevated privileges at the beginning. The name of the file is “TeamViewer_Setup.exe”
So it can be done in Vista without elevation in the beginning.

It’s all about the embedded manifest!

By: Craig Stuntz

Craig Stuntz — Thu, 19 Mar 2009 23:21:11 +0000

If your application appears (to Vista) to be an installer, then it *will* request elevation, no matter what it actually does. Try and write an application called setup.exe and see what happens. Or write a do-nothing installer with any popular install product. Microsoft thinks that you *should* put your application in Program Files, and therefore your installer should need elevation. If you wanted to write an installer which didn’t need elevation, then you would need to fool Windows into thinking that it was not, in fact, an installer.

By: Christian Wimmer

Christian Wimmer — Thu, 19 Mar 2009 18:38:53 +0000

I can install applications on my system without administrative rights and with activated UAC because I don’t use the “Program Files” folder. I install applications on a separate partition. So this isn’t moot in Vista.

The installation process doesn’t need administrative rights by itself – it is just made this way because it changes protected resources (like registry). But many applications don’t use these resources anyway, so why are they changed at all?

By: Xepol

Xepol — Thu, 19 Mar 2009 18:20:30 +0000

Your entire discussion may well be moot. Since Vista, you need administrative rights to write any files into Program files folder if UAC is enabled. ( http://technet.microsoft.com/en-us/library/cc709628.aspx )

So, basically, YES, you need administrative rights to install an application (at least if you do it correctly).

Which makes sense to me. If it had been that way in past, many of the malware apps my children downloaded to their machines may well have been avoided since they did not have administrative rights. Installing software is a form of administration, only the administrator should be able to do it, thus you should need administrative rights to accomplish it.

If anything, I would extend the system to require someone with administrative rights to sign off on ANY new executable content on a system before it was allowed to run. Of course, this would confuse and frustate novices, so it won’t happen.