从提升的/作为管理员进程运行非提升的子进程 [英] Run child process non-elevated from an elevated/As Admin process

问题描述

我的应用程序通过另一个名为"updater.exe"的应用程序具有内置的自我更新系统，该应用程序与要更新的主应用程序位于同一文件夹中.它会下载最新版本，终止旧版本(如果正在运行)，然后将其覆盖.

My application has a built-in self update system via another app called "updater.exe" which is in the same folder with the main application to update. It downloads the newest version, terminates the old one (if it's running) and then overwrites it.

问题是，要做到这一点，必须以管理员权限运行updater.exe才能访问C:\Program Files\MyApp

The problem is, to do that the updater.exe must be run with the Administrator privileges in order to have access to C:\Program Files\MyApp

到目前为止，主应用程序已使用Admin特权(使用UAC)运行updater.exe，但随后出现了问题:

So far so good, the main app runs the updater.exe with Admin privileges (using UAC) but then the problem appears:

更新完成后，我希望新安装的版本自动启动.你猜怎么了?当然，主应用程序也具有Admin特权运行.场景很简单:

After update is completed, I want the new installed version to start automatically. Guess what? Of course the main app runs with the Admin privileges also. The scenerio is simple:

Main app[running as user] --> Updater App[run as admin] --> Main app[ADMIN again]

仅仅因为我的应用程序使用My.Settings对象，它以管理员身份运行时会丢失所有存储的设置，因为通常它总是以普通用户身份启动，并且您可能知道My.Settings是user-sensivite对象.

Just because my application uses My.Settings object, it loses all the stored settings when it run as admin because typically it always start as normal user and as you may know, My.Settings is user-sensivite object.

如何解决此问题?我到处搜索，但找不到与以普通用户身份运行"相关的任何内容，但始终以admin身份运行，这非常容易.

How can I fix such an issue? I've searched around but could not find anything related to "Run as normal user" but always running as admin, which is quite easy.

老实说，另一方面，我认为不可能发生这种情况，因为更新器应用程序无法知道是哪个特定的用户启动了它.可以吗我在这里想念什么吗?

Well, honestly, in the other hand, I don't think such a thing could be possible because the updater app cannot know which specific user has started it. Or can it? Is there something I'm missing here ?

如果我是对的，这是不使用My.Settings而不是Windows注册表来存储用户首选项的唯一选择吗?

If I am right, it is the only option to NOT to use My.Settings but the Windows Registry to store user preferences?

谢谢.

推荐答案

降级"子进程的一种方法是通过资源管理器启动它.通常应该与普通的Win用户一起使用.但是，如果资源管理器本身运行状况较高，那么您尝试启动的应用程序也将运行.资源管理器可能正在运行提升，原因是:

One way to "de-elevate" a child process is to start it via Explorer. This should generally work with normal Win users. But if Explorer itself is running elevated, then so will the app you are trying to start. Explorer may be running elevated because:

• 活动用户是Admin(不仅是具有admin privs的用户)
• Explorer.exe是从命令窗口(重新)启动的，您知道了它，正在提升运行状态

• The active user is Admin (not just a user with admin privs)
• Explorer.exe was (re)started from a command window which...you got it, is running elevated

...以及其他人.

... and probably others.

最好将其视为使用默认权限启动应用程序.如果运行提升资源管理器，则将提升新实例的运行，但是原始的第一个 Main App 实例也将运行提升的资源.

Its better to think of this as starting the app with default rights. If running elevated Explorer will start the new instance elevated, but original first Main App instance would also have run elevated.

使用复选框选择是否提升权限来测试代码以启动同一应用程序:

Test code to start the same app using a checkbox to select elevated or not:

Dim proc = New Process
proc.StartInfo.UseShellExecute = True
proc.StartInfo.WindowStyle = ProcessWindowStyle.Normal
proc.StartInfo.WorkingDirectory = mypath

If chkAdmin.Checked Then                    ' run this app as admin
    proc.StartInfo.FileName = myApp
    proc.StartInfo.WorkingDirectory = mypath
    proc.StartInfo.Verb = "runas"           ' run "me" as admin
    proc.StartInfo.Arguments = ""
Else                                        ' run explorer w/app as arg
    ' de-elevate new app instance to run de-elevated
    proc.StartInfo.FileName = Path.Combine(windir, "explorer.exe")  
    proc.StartInfo.Verb = ""                ' important!
    proc.StartInfo.Arguments = myApp        ' send the child app name as arg
End If

proc.Start()

此图显示结果:

表单顶部的标签指示 应用是否正在提升运行状态，每个应用实例均由其前一个实例启动.

The label at the top of the form indicates whether that app is running elevated, each app instance was started by the one before it.

第二个窗口向下运行.当启动下一个实例时，未选中作为管理员的复选框；结果，第三个实例是通过资源管理器启动的，不是运行提升了.与#4从#5开始相同.

The second window down is running elevated. When it started the next instance, the check box for As Admin wasn't checked; as a result the 3rd instance was started via Explorer and is not running elevated. Same for #4 starting #5.

这篇关于从提升的/作为管理员进程运行非提升的子进程的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！