以比“以管理员身份运行"更少的权限启动应用程序； [英] Launch application with less permissions than "Run As Admin"

问题描述

我有一个需要以Admin身份运行的应用程序. -没问题.

I have an application which needs to run As Admin. - no problems with this.

此应用有时有时需要启动辅助应用，但是第二个应用从父应用继承了以管理员身份运行"提升的状态.我不希望这样，我想以与不启动以管理员身份"时授予的相同权限来启动第二个应用程序.

This app sometimes needs to launch a secondary application, however this second application inherits the "Run as Admin" elevated status from the parent application. I don't want this, I would like to launch the second application with the same rights as would be granted when not launching "As Admin"

相反，在这种情况下，我可以找到许多文章，但对于降低访问权限却找不到.

I can find many articles for this scenario the other way round, but none for lowering access rights.

这可能吗?

推荐答案

此MSDN帖子将我重定向到由于从高程开始进行非高程过程容易出错，因此提出了以下建议:

It proposes the following since starting a non-elevated process from an elevate is error-prone:

1. 您的应用最初是作为非高架应用启动的，其清单具有asInvoker级别.

启动时，它会使用runas动词以提升的特权重新启动自身，并传递命令行参数来指示它.该实例执行需要管理员权限的所有部分.

When it starts, it restarts itself with elevated privileges using runas verb, and passes a command-line parameter to indicate it. This instance performs all parts that need admin priviledges.

此处再次出现非提升应用程序，并使用与步骤1中启动该应用程序第一个实例相同的非提升用户令牌启动辅助应用程序.

Here comes the non-elevated app again, and starts your secondary application with the same non-elevated user token that started the first instance of the app in step 1.

我希望无论如何都可以将其应用于您的情况.

I hope this can anyhow be applied to your scenario.

如前所述，您想要实现的是非常容易出错的，但是

As said, what you want to achieve is very error-prone, yet in this SO question there are some possible hacky solutions.

这篇关于以比“以管理员身份运行"更少的权限启动应用程序；的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！