为什么我的应用程序以管理员身份运行时工作不同？ [英] why does my application work differently when running as administrator?

问题描述

我有一个小型Delphi应用程序，将一个键写入LOCAL_MACHINE注册表。
当我在具有管理员权限的用户的Windows 7专业版上运行它时，它无法写入该值，但是当我右键单击并选择以管理员身份运行时，它将工作。

代码是：

  var 
 reg：TRegistry; 
 begin 
结果：= false; 
 
 reg：= TRegistry.Create; 
 reg.RootKey：= HKEY_LOCAL_MACHINE; 
 if（reg.OpenKey（'Software\YepYep'，TRUE））然后
开始
 try 
 reg.WriteString（'ProductKey'，Trim（ProductKey））; 
结果：= true; 
 finally 
 reg.CloseKey（）; 
结束
结束; 
 reg.Free; 
 
 end; 
  

计算机UAC设置设置为仅当程序尝试更改我的电脑时通知（第二低）。当我把它从不通知它也有效（不需要使用以管理员身份运行）。

如果您有任何想法/想法可能是这个问题，我会很乐意听到他们。

谢谢。

解决方案

简单来说，用户需要管理员权限才能写入HKLM。同样用于写入系统目录（system32，程序文件）。对于实现安全性（NT，2k，XP，Vista，7）的Windows版本，这一直是真实的。

在UAC下，管理员组中的用户运行进程默认，使用标准用户令牌。所以他们不能访问HKLM等。

你真的需要在进一步了解UAC之前阅读。开始 here 。

一旦您熟悉这些问题，您将有两个主要选项：

1. 添加 requireAdministrator 清单到您的应用程序，使其始终运行与提升特权这意味着用户每次启动应用程序时都必须协商UAC对话框。


2. 重新整理您的应用程序，使其不写入HKLM。一种常见的方法是在安装期间完成需要管理员权限的所有操作，通常会升高。另一个变体是将需要管理员权限的应用程序的一小部分隐藏到单独的进程中，以便在必要时仅显示UAC对话框。

在这两个选项中，数字2绝对是首选。请记住，您的应用程序在非管理员用户的2000 / XP上已经无法使用。

I have a small Delphi application that writes a key to the LOCAL_MACHINE registry. When I run it on Windows 7 professional with user that has administrator privileges it fails to write the value, but when I right click and choose "Run as administrator" it does work.

The code is:

var
   reg : TRegistry;
begin
 Result := false;

 reg := TRegistry.Create;
 reg.RootKey := HKEY_LOCAL_MACHINE;
 if (reg.OpenKey('Software\YepYep', TRUE)) then
 Begin
      try
         reg.WriteString('ProductKey', Trim(ProductKey));
         Result := true;
      finally
             reg.CloseKey();
      end;
 End;
 reg.Free;

end;

The computer UAC settings are set to "Notify only when programs try to make changes to my computer" (second lowest level). When I take it down to "Never notify" it also works (with no need to use "Run as administrator").

If you have any ideas/thoughts about what could be the issue, I would appreciate hearing them.

Thanks.

解决方案

Simply put, a user needs administrator rights to write to HKLM. Likewise for writing to system directories (system32, program files). This has always been true for Windows versions that implemented security (NT, 2k, XP, Vista, 7).

Under UAC, users in the administrators group run processes, by default, with a standard user token. So they do not get write access to HKLM etc.

You really need to read up on UAC before going much further. Start here.

Once you are familiar with the issues you have two principal options:

1. Add a requireAdministrator manifest to your application so that it always runs with elevated privileges. This means that the user will have to negotiate the UAC dialog every time they start your application.
2. Rework your application so that it does not write to HKLM. A common approach is to do everything that needs admin rights during installation which typically happens elevated. Another variant is to hive off the small part of your app that needs admin rights to a separate process so that you only present UAC dialogs when necessary.

Of these two options, number 2 is most definitely to be preferred. Bear in mind that your application already did not work on 2000/XP for non-administrator users.

这篇关于为什么我的应用程序以管理员身份运行时工作不同？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！