Why does IDE require UAC elevation when starting?

[Tom F 85]

I'd been using Alexandria until this morning. For as long as I  remember, Alexandria  showed the UAC pop-up "Do you want to allow this app to make changes..." when started.  



In the past, with Alexandria (being run elevated) I occasionally encountered problems with GetIt packages and others (like Quick Access Popup) that I attributed to somehow my not installing Alexandria properly. For example, drag-and-drop using DropMaster didn't seem to work when I ran my app from inside the IDE.

I had hoped that doing a clean install with a new version of RAD Studio would eliminate the UAC elevation requirement.

However, having just installed Athens, I still get the same UAC elevation pop-up when starting it.



Has Rad Studio always required UAC elevation?  Are there ramifications to add-ins because of that?  Are their ramifications of running the IDE in the required elevated status like not appearing as a drop target when dragging from an unelevated app? Is there any safe and easy way to avoid any of this other than changing my Windows UAC level on the screen below?

Here's my current UAC setting:

Edited May 20 by Tom F
Clarification

[FPiette 384]

I have the same UAC setting as you but I don't have any issue with the IDE requesting elevated privileges. There is something suspect on your system. Don't relax UAC settings!

[Roger Cigol 103]

I've been using RAD Studio since 2009 (ie pre "XE" days") and never had to use elevated privileges to run the IDE. 12.1 exactly the same.....

1 hour ago, FPiette said:

There is something suspect on your system. Don't relax UAC settings!

I second this.

[Tom F 85]

2 minutes ago, Roger Cigol said:

I've been using RAD Studio since 2009 (ie pre "XE" days") and never had to use elevated privileges to run the IDE. 12.1 exactly the same.....

I second this.

Thanks, guys, for the feedback.  Now I just have to figure why my Win10 machine is requiring a UAC elevation for a standard install from the ISO.

[Roger Cigol 103]

I've used ISO and web based installers for different installations - no difference between them.

[Lajos Juhász 293]

I am using ISO to install Delphi, never have had to start it elevated.

[Tom F 85]

1 hour ago, Lajos Juhász said:

I am using ISO to install Delphi, never have had to start it elevated.

I know very little about UAC settings, but I think the only way that could happen is if you had the UAC Settings screen set to "Never Notify." Is that the case?

[Jim McKeeth 106]

Is the user you are running under Administrator or Standard? I've not tried running the IDE under a Standard user.

 

It could also be a setting in your shortcut. Make sure "Run program as Administrator" isn't selected under the Compatibility tab. 

[Lajos Juhász 293]

6 hours ago, Jim McKeeth said:

Is the user you are running under Administrator or Standard? I've not tried running the IDE under a Standard user.

For me this is the first time that I am using a standard user, the IDE works without a problem.

 

6 hours ago, Tom F said:

I know very little about UAC settings, but I think the only way that could happen is if you had the UAC Settings screen set to "Never Notify." Is that the case?

 

I have the default UAC for standard users, that is Always Notify.

 

[FPiette 384]

8 hours ago, Lajos Juhász said:

I am using ISO to install Delphi, never have had to start it elevated. 

To be clear, the question is not about Delphi installer. The elevated privileges are requested when running the IDE, after installation.

Or is it me that did not understood the question ?

[Lajos Juhász 293]

Correct the IDE. The question was if using ISO and WEB installer will behave differently.

Edited May 21 by Lajos Juhász
EDIT. The installer of coursre always requires to be elevated.

[Roger Cigol 103]

9 hours ago, Roger Cigol said:

I've used ISO and web based installers for different installations - no difference between them.

Everyone accepts that it is correct that you need elevated privileges to install. "There is no difference between them" means for me either route has always led to being able to run the IDE from a "standard user" account without elevated privileges.

[Tom F 85]

16 hours ago, Jim McKeeth said:

Is the user you are running under Administrator or Standard? I've not tried running the IDE under a Standard user.

 

It could also be a setting in your shortcut. Make sure "Run program as Administrator" isn't selected under the Compatibility tab. 

I'm always logged in as an admin user. 

The desktop shortcut created by the installer does NOT have "Run this program as admin" checked. (Good thought , though!)

Running bds.exe from the File Explorer has the same problem.

[FPiette 384]

Is it a basic setup using default options and folders? Anything added after setup, like libraries, components, experts, addons and similar?

[Tom F 85]

10 minutes ago, FPiette said:

Is it a basic setup using default options and folders? Anything added after setup, like libraries, components, experts, addons and similar?

Good questions. Yes, default installation and I’ve  added nothing to the IDE. 

[David Heffernan 2347]

52 minutes ago, Tom F said:

The desktop shortcut created by the installer does NOT have "Run this program as admin" checked. (Good thought , though!)

Running bds.exe from the File Explorer has the same problem.

Right click on bds.exe and check what its compat settings are too

[Tom F 85]

@David Heffernan  Good question!  Thanks for your suggestion.

There are no compatibility settings set on the desktop icon Properties screen. This is the default icon created by the installer.  And bds.exe is the same. 

[JonRobertson 72]

Have you tried launching BDS with a different registry key? This would not load components installed after the IDE was installed. In my tests, experts and add-ins are still loaded. For example:

bds -r"clean"

I wonder if there is something else (such as a DLL) being loaded by the IDE that is triggering the elevation requirement. Using Process Monitor could be helpful to track what BDS is doing before the elevation dialog appears.

[Tom F 85]

@JonRobertson:  This a totally clean install, with no additional components added.  I tried your bds -r"clean" suggestion and still had the UAC elevation pop-up.

I also tried your suggestion of monitoring with ProcMon and got results that don't seem to reveal anything of interest.


 

[JonRobertson 72]

This is a stretch, but you could extract the manifest from your bds.exe and verify that the manifest is not requiring elevation. The link has a sample command-line, which I just used on my bds.exe. If you have Visual Studio installed, mt.exe should already be on your machine. I don't know if there is a way to get it that is simpler than installing the Microsoft Windows SDK.

 

I can't imagine this is the cause with a standard install. But there is something triggering the request. The manifest should contain this line:

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

 

[Tom F 85]

@JonRobertson Cool suggestion!  Thanks.

I'd never used mt.exe.  Unfortunately, the requestedExecutionLevel is as you suggested, "asInvoker"



And, I am an admin:

[Brian Evans 108]

Note Windows does not allow drag and drop from a lower privileged process to a higher privileged one.  It is part of UIPI (User Interface Privilege Isolation).

 

If you run Delphi elevated the default file explorer which runs as a regular user will have issues with dropping to Delphi. 

[Tom F 85]

@Brian Evans

 

11 hours ago, Brian Evans said:

Note Windows does not allow drag and drop from a lower privileged process to a higher privileged one.  It is part of UIPI (User Interface Privilege Isolation).

 

If you run Delphi elevated the default file explorer which runs as a regular user will have issues with dropping to Delphi. 

That's why I'm trying to fix this.

[Tom F 85]

FIX FOUND!  My bds.exe is no longer insisting it is run with Administrator privileges. 

 

This area of Windows is new to me, so perhaps my analysis and solution below are incorrect. Please be gentle on me if I'm wrong about all this!

 

I know of four ways that Windows determines whether an exe requires UAC Admin elevation (Run as Admin). 

1. The flag/checkbox on a desktop icon's Property screen's Security tab

2. The standard registry.

3. An Application Compatibility database (?) described by wosHub (or is this just the registry as edited by Microsoft's Application Compatibility Administrator?)
4. The .exe's manifest 

I found an easy way to view and edit the registry keys using Nirsoft's AppCompatibilityView (https://www.nirsoft.net/utils/app_compatibility_view.html) (Of course, RegEdit would work too, but you'd have to know all the fields and flags to do it manually like that)

 

Nirsoft's AppCompatibilityView showed that the registry contained an entry that was forcing Windows to launch bds.exe with administrative rights. (See attached screen capture of the Nirsoft app)

After I deleted that entry, the bds.exe Ran as Invoker and did not require UAC elevation. I believe that the D12 installer must have added an entry to the registry that forced UAC elevation for administrative rights.  I don't know why the installer would do that. Nor do I know how else that entry could have occurred. 

After I deleted the registry entry using Nirsoft's app, I uninstalled (thoroughly with Revo) and re-installed D12.

Now, when I launched the bds.exe, it started without the UAC popup. But... I then got:  Exception Exception in module coreide290.bpl at 0000F3B3. Internal Error: AppIniFile was not initialized.

If I ran as Admin, I did not get that error.  Other than one unresolved RSP in the old JIRA database, I could find nothing about this error.  I couldn't find a file on my machine with the name "AppIniFile." And, Procmon didn't give me any further information about what was going on either.

 

I was able to follow the instructions at https://woshub.com/how-to-disable-uac-for-specific-applications/ to create a batch file that when run, causes the bds.exe to run with RunAsInvoker. I wasn't happy with a batch file sitting between my keyboard and launching bde.exe. (For example, what would happen if I double-clicked on a .dproj in the Windows Explorer?  The .bat file wouldn't be run so bds.exe would again require UAC elevation.) 

 

As an alternate approach, I  followed the instructions on the above woshub page to create a registry key that would flag bds.exe to be always RunAsInvoker. Here's the key:

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers]
"C:\\Program Files (x86)\\Embarcadero\\Studio\\23.0\\bin\\bds.exe"="RunAsInvoker"

You could do the same thing more easily with Nirsoft's app using its Action menu or right-clicking on app there.

 

I did not take the time to try the Application Compatibility Toolkit method (as described at woshub) to modify the Windows compatibility database.

Like I said, this is all new to me... and apparently it's new to most people.  I don't if my thinking is correct, but bds.exe is launching properly... at least for the time being.

If this write-up helped you solve a problem you've been having, DM me to let me know it was worth the time I spent writing it out here!

Tom

 

 

 

 

Edited May 22 by Tom F

[Brandon Staggs 278]

Well, none of that should be necessary. I've never had to run as admin or approve an elevation prompt to use Delphi, including with version 12.

 

Is it possible you are using "tools" that "optimize" your registry, or that you're using really crappy anti-virus that might be causing these problems, like WebRoot, etc?