[RESOLVED] How to give admin rights to a specific software for standard user accounts?

My software reads/writes to the registry and to the database in the local installation directory.

It runs fine when the user is logged in as an administrator, however if logged in as a standard user the software cant access the registry or database fully so fails to run

I've tried setting the security permissions to full access for "users" on both the registry node and the installation folder but still have a problem.

Is there any other settings i can try to change?

I also have the following in the app.manifest

Code:

---

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

---

I seem to have said this a lot lately but it is for the computer admin to determine what software can and cannot be run by standard users, not you. You obviously must inform anyone using your software that it can only run in administrator mode and they must decide what to do about it. If your application seeks to override local security settings in any way then it risks being flagged as malware (not unreasonably!) which means your career as a software supplier is likely to be a very short one!

The software is being used on a corporate network, all the users are "standard users" and the IT support are reluctant to grant the users admin rights.

I want to try to solve / fix the issue if possible rather than saying admin rights are required

My options as of now are:

1. Look for a way to allow read/write permissions to the registry for standard users
2. Ask the IT support to create a local account on the PC setup as a "power user" - not sure if they would like that!?
3. Rewrite the software to remove all registry entries and move them to the database instead
4. I think the issue is writing to HKEY_LOCAL_MACHINE - maybe change the software entries to write to HKEY_CURRENT_USER?

1. Not possible
2. Don't poke the wasp's nest!
3. That's the way to do it!

Quote:

---

Originally Posted by experience

The software is being used on a corporate network, all the users are "standard users" and the IT support are reluctant to grant the users admin rights.

I want to try to solve / fix the issue if possible rather than saying admin rights are required

My options as of now are:

1. Look for a way to allow read/write permissions to the registry for standard users
2. Ask the IT support to create a local account on the PC setup as a "power user" - not sure if they would like that!?
3. Rewrite the software to remove all registry entries and move them to the database instead
4. I think the issue is writing to HKEY_LOCAL_MACHINE - maybe change the software entries to write to HKEY_CURRENT_USER?

---

1. Not possible
2. Not worth the effort, they'll most likely laugh at you and deny the request

4. What are the registery values for? Are they needed for system wide settings or just for whatever user is running your application? If it's just for whatever user is using the application then use HKCU (HKEY Current User) instead. There is extremely few cases where your apps will need to write to anything other than HKCU, more than likely you could have a single table in the database with a single row that would hold the data you're currently storing in the registry, but that only works if each user on the computer has their own copy of the database that the program uses. See below on my database placement ideology.

3. As for your database, unless it's a database to be used by everyone on the computer, you should have your app copy the DB from the installation directory to the user's ApplicationData folder on it's first use and your app uses it from there. Your application has read-only access to anything in either of the Program Files folders (as it should be) so your app can read the DB to make a copy of it to a folder where it has access to write to it, which would be the ApplicationData folder in the users profile.
If your database needs to be accessed by all users on the current computer, use the ProgramData folder in the root of the windows install drive (typically it's C:\ProgramData, but could be D:\ProgramData if Windows is installed on the D: which is a rare case, but you should account for that anyways.)

I've done a quick find/replace to change all the registry entries to the HKEY_CURRENT_USER - i didnt realise when i originally wrote it that the registry nodes had different write permissions.

As for the database, access is needed to read/write to it by all users

If i change the database installation location to C:\ProgramData\database.mdb will that be fully accessible to read/write for standard users?

I take it that the path for that would be :

HTML Code:

---

Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData)

---

Quote:

---

Originally Posted by experience

I've done a quick find/replace to change all the registry entries to the HKEY_CURRENT_USER - i didnt realise when i originally wrote it that the registry nodes had different write permissions.

---

That was easy enough.

Quote:

---

Originally Posted by experience

As for the database, access is needed to read/write to it by all users

If i change the database installation location to C:\ProgramData\database.mdb will that be fully accessible to read/write for standard users?

---

Yes, that's the main purpose of the folder, a common folder for all users to access the same files.

Quote:

---

Originally Posted by experience

I take it that the path for that would be :

HTML Code:

---

Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData)

---

---

That's correct.

Excellent, many thanks for the pointers :)

Right im off to change a couple of paths