[RESOLVED] When I try to uninstall my own application I get "You do not have sufficient access"

Hello everyone,

I am facing a rather annoying problem. I have developed a VB6 application (ancient I know) but this issue happens regardless of the programming language used to make the app. The application consists of a single EXE file. Now I am trying to add install/uninstall capabilities to it without using external setup packagers like InstallShield or whatnot..

For example I have programmed the command-line switch "/install" to add the necessary registry key values under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall

This has worked flawlessly. Now my application appears in the "Programs and Features" list along with all other installed programs from my computer. Now when I click the "Uninstall/Change" button it is supposed to execute the contents of the "UninstallString" key which is calling my application with the "/uninstall" switch. This in turn will delete itself and remove the entry from the registry.

The problem is that when I click the "Uninstall/Change" button I get an error message saying that I do not have sufficient access to uninstall my app even though I am logged on as an administrator.

It is worth mentioning that if I right click on the executable file, select "Properties" and check the "Run as administrator" option then the uninstall will work like a charm but I would like to know how to make it work without running it as administrator. I mean all other applications can be uninstalled just fine and they are not running as administrator. Also the uninstall will work flawlessly on Windows XP but that was something to be expected. The problem happens both in Vista and Windows 7. In Vista I even get an UAC prompt and after I confirm that it still tells me that I don't have sufficient access.

Any insight into this matter is greatly appreciated. Thank you.

Melissa

Welcome to the Forums .. :wave:

Sadly, I do not have sufficient experience to address
your problem, but hopefully someone else will.

Nonetheless, let me just say that your explanation
of the situation is exemplary, and warrants a :thumb:

Spoo

Quote:

---

Originally Posted by Melissa Perry

... The problem happens both in Vista and Windows 7. In Vista I even get an UAC prompt and after I confirm that it still tells me that I don't have sufficient access.

---

This part is a little confusing.

If you manually try to run the program elevated this prompt would be expected. So are you suggesting that you see the prompt under Vista even when you run the program as a standard user?

Something doesn't add up. Surely you aren't spawning copies of regsvr32.exe to do this???


What libraries are you trying to register? How are you ensuring you are registering them under HKCU instead of HKLM?


And you should note that programs that try to bundle PE files as resources will often trigger anti-malware alerts. They often look like a trojan horse to such software. Plus the resulting program eats a ton of extra RAM when running, carrying along the baggage of those embedded libraries.

Thank you for your response. I'll try to answer your questions:

I am always logged on as an administrator on all my operating systems (XP, Vista, 7), I do not create other user accounts.

When I try to uninstall the program in Vista I get the usual UAC prompt and I click Continue. After that I get an error prompt telling me that I do not have sufficient access to uninstall this application and that I should contact the system administrator.

In Windows 7 I don't get any UAC prompt, instead it immediately prompts me that I don't have sufficient access (the message is identical).

If I edit the properties of the EXE file and select the "Run as administrator" check-box then the uninstall process is completed successfully although I still get the UAC prompt in Vista.

I do not have any external DLLs or ActiveX that require registration with regsvr32. The whole application is just a single EXE file. When I install it with the "/install" command-line switch it specifically creates the sub-key under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall section. As a result now it appears in the Add/Remove list of programs in control panel just the same as all other programs.

For ease of use I distribute the application as a WinRAR Self-Extract archive which will execute the applicationname /install after extracting it.

The "UninstallString" key contains the path to the program followed by the "/uninstall" command-line switch which will remove the registry key from the Uninstall section and then delete the EXE file (using cmd.exe /C del applicationname.exe & rd applicationfolder). I have looked at all other programs present in the Add/Remove list and they all follow this pattern so I just did what they are doing.

The program is a legitimate application, it is not malware in any way. Furthermore it is digitally signed with a certificate found in the Trusted Root Certification Authorities so it will never be picked up as malware. It does not bundle anything else although it does pack a standard resource file containing text strings for internationalization purposes. The manifest file is set to run "asInvoker".

I think this issue will happen with any application that writes a key in the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall section. I must be missing something that a regular InstallShied application is doing so that it doesn't get the insufficient access message when trying to uninstall it. The problem is that I didn't find any documentation regarding this issue...

Hello Melissa,

I feel your pain. Some of the applications I wrote for automating MS Office last year have rebounded back to me due to this issue.
The scenario for me to overcome this is twofold. To run the apps under Win 7 (even logged in as administrator) was to right click on the app shortcut and select 'Run As Administrator'. The second was to instruct the individual how to run the application (without reducing the security level).

In your scenario this is going to prve a challenge. But there is a proviso within Win 7 to reduce the level of UAT.
Control Panel | System and Security | Action Centre (choice) change user account control settings (link). Reduce this using the slide bar and attempt anothe uninstallation.

Good luck and kind regards

Steve

This doesn't look like an acceptable solution. There must be a way to uninstall my application the same way as any other application from the Add/Remove list without requiring special access or running it as administrator. I must be missing something very easy here...

Quote:

---

Originally Posted by dilettante

This part is a little confusing.

If you manually try to run the program elevated this prompt would be expected. So are you suggesting that you see the prompt under Vista even when you run the program as a standard user?

Something doesn't add up. Surely you aren't spawning copies of regsvr32.exe to do this???


What libraries are you trying to register? How are you ensuring you are registering them under HKCU instead of HKLM?


And you should note that programs that try to bundle PE files as resources will often trigger anti-malware alerts. They often look like a trojan horse to such software. Plus the resulting program eats a ton of extra RAM when running, carrying along the baggage of those embedded libraries.

---

Thank you for your response. I'll try to answer your questions:

I am always logged on as an administrator on all my operating systems (XP, Vista, 7), I do not create other user accounts.

When I try to uninstall the program in Vista I get the usual UAC prompt and I click Continue. After that I get an error prompt telling me that I do not have sufficient access to uninstall this application and that I should contact the system administrator.

In Windows 7 I don't get any UAC prompt, instead it immediately prompts me that I don't have sufficient access (the message is identical).

If I edit the properties of the EXE file and select the "Run as administrator" check-box then the uninstall process is completed successfully although I still get the UAC prompt in Vista.

I do not have any external DLLs or ActiveX that require registration with regsvr32. The whole application is just a single EXE file. When I install it with the "/install" command-line switch it specifically creates the sub-key under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall section. As a result now it appears in the Add/Remove list of programs in control panel just the same as all other programs.

For ease of use I distribute the application as a WinRAR Self-Extract archive which will execute the applicationname /install after extracting it.

The "UninstallString" key contains the path to the program followed by the "/uninstall" command-line switch which will remove the registry key from the Uninstall section and then delete the EXE file (using cmd.exe /C del applicationname.exe & rd applicationfolder). I have looked at all other programs present in the Add/Remove list and they all follow this pattern so I just did what they are doing.

The program is a legitimate application, it is not malware in any way. Furthermore it is digitally signed with a certificate found in the Trusted Root Certification Authorities so it will never be picked up as malware. It does not bundle anything else although it does pack a standard resource file containing text strings for internationalization purposes. The manifest file is set to run "asInvoker".

I think this issue will happen with any application that writes a key in the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall section. I must be missing something that a regular InstallShied application is doing so that it doesn't get the insufficient access message when trying to uninstall it. The problem is that I didn't find any documentation regarding this issue...

Obviously there is a permissions problem.

But I don't even think it's about permissions on the registry key is it? Exactly what does this "do not have sufficient access to uninstall this application" message look like? Is it a system dialog, default VB6 exception dialog, or one your program displays?


Your use of this key under HKCU would seem to imply you want to do a per-user install. Can we assume the desire here is to allow install and uninstall by a user who cannot elevate (has no admin rights himself)?

If so, even if we get past your current problem this may be doomed. Using the Control Panel applet always requests elevation except for the special case of a per-user Windows Installer install as far as I know. If that's true any standard user trying to use your program will never be able to uninstall cleanly. If they supply an admin's credentials at the elevation prompt your program will be running in the wrong user context to delete the registry key.

It's definitely a system dialog. It just says:

"You do not have sufficient access to uninstall <application name>. Please contact a system administrator."

But I AM a system administrator and it doesn't make any difference!

I am using the HKCU especially to get rid of the restrictions involving HKLM. When I use HKLM instead I get the UAC prompt twice and I have to click Continue twice (which is not a problem) but after that I still get the "You do not have sufficient access" prompt so the problem remains unsolved.

Have you looked at the "checked" answer (green) here yet?

http://social.technet.microsoft.com/...-49e4160fe991/

Yes, that is not helpful and it doesn't apply to this issue. I guess the question can be rephrased as "How can you make an uninstaller for your application without using third party tools?".

I'm not sure you can really, unless you are willing to install and uninstall with elevation.

Are you sure that InstallShield uses HKCU and not HKLM?

I suspect you might be "installing" as a standard user and then "uninstalling" elevated. The context mismatch could be part of the problem. Did you say that if you install by manually requesting elevation (run as administrator), the Control Panel uninstall works?

The fact that you see two UAC prompts when you use HKLM already makes me think something funny is going on. When you did this were you also using an elevation manifest in your program?


Remember, the Control Panel process is really a Windows Installer function. It only handles legacy setups via appcompat shims, they really don't belong there. If you had an Installer MSI instead it is quite possible to do an unelevated install and uninstall "per user" because it knows how to handle its own.

If you are installing to Program Files you're probably creating a virtualized file mess as well.

I am VERY willing to install and uninstall with elevation. But the elevation must be done programmaticaly by the UAC and not having to force the user to edit the program's properties and click "Run as administrator". That is not an acceptable solution.

The HKCU is an acceptable place for the UninstallString just as well as the HKLM (which isn't working either). For example Google Chrome uses HKCU for its uninstall information.

There is nothing virtualized here. The program is actually installing correctly in Program Files (which is the proper place to install all applications). That is why the program has a manifest and it's digitally signed, especially to avoid virtualization.

The installation is done by the WinRAR Self-Extract archive (which is also digitally signed) and it does require an UAC prompt in both Vista and Windows 7. After it finishes extracting the application in Program Files it simply calls the application with the "/install" switch to create the necessary Uninstall information in the registry so that it appears in the Add/Remove Programs list.

I don't see what's so special about a MSI installer. What does it do that I can't do it myself? In fact I think this is THE question here... The whole process works very well in WIndows XP and it also works in Vista and Windows 7 when the executable is marked to "Run as administrator". So it seems like the solution is within reach and yet it has eluded me so far...

This issue has been solved. The manifest needs to specify: requestedExecutionLevel level="highestAvailable" uiAccess="false"

Then it will work just fine. If uiAccess is "true" then you get the insufficient access error. If requestedExecutionLevel is "asInvoker" then the executable will not be deleted from Program Files.

I hope this will help anyone else facing this problem.