Author: AS2020Subject: SigCheck/ Program Manifests
Posted: 24 September 2017 at 1:47am
I discovered the SigCheck utility the other night and like most of the Sysinternals family of utilities, it looks like a real lifesaver when it is needed. An application vendor whose product generates a UAC prompt whenever the program is run insisted that it wasn't anything the program was doing, but rather some vague, unspecified "problem with the user account." The only "problem" was that it was a standard user account, though they claimed that the program did not need administrator privileges and refused to help me any further.
Highly annoyed, I started digging around for a real answer, which led me to SigCheck. I dumped the program's manifest, and sure enough, it contained the following line:
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
Of course, this is what is generating the UAC prompt as far as I can tell. I created a "RunAsInvoker" shim with the Application Compatibility Toolkit and after that, no UAC prompt, and it seems to run fine otherwise. The vendor claims that over 5,000 other sites do not have or need this fix. My contention now is that if that is true, and the other sites are running the same executable in Windows 7, 8, or 10, they must be working around the problem in essentially one of three other ways: either disabling UAC, giving the user account administrator privileges, or giving the staff an administrator password, all of which I find unacceptable in today's environment. I can't imagine anything else that an average IT administrator would implement; even the Application Compatibility Toolkit is really an advanced topic. The vendor will not explain exactly how these other sites are running the program without one of the workarounds I suggested; essentially, all I am getting is stonewalling. It seems to me that simply removing the line in the manifest would fix this without lowering security.
I am sick of application vendors that do not understand basic Windows architecture, don't give a hoot about security, and refuse to fix their products, and I am planning to make an issue of this until they fix the program. Am I missing anything? Without lowering security, is there any other way to work around a manifest that requests administrator privileges? I just want to make sure I'm on solid ground here before I make a fool of myself.
-- Andrew
Edited by AS2020 - 6 hours 18 minutes ago at 1:50am
