我们可以让 UAC 提示只显示一次吗? [英] Can we get the UAC prompt to show only once?
问题描述
有没有办法让应用在首次运行时只向用户显示一次 UAC 提示.此后，不再提示.
Is there a way for an app to present the user with the UAC prompt only once, upon first running. Thereafter, no further prompting.
换句话说，我了解我们的应用需要用户的 UAC 权限才能执行某些操作.这很好.但我们不希望它在每次运行时都不断询问.用户可以一直授予我们的应用程序权限吗?还是我的要求违反了 UAC 的基本原理?
In other words, I understand that our app needs the user's UAC permission to do certain things. And that's fine. But we don't want it to have to keep asking on every occasion it runs. Can the user give permission to our app for all time? Or does what I am asking violate the fundamentals of UAC?
我们正在使用 .NET 和 Windows 7
We are working with .NET and Windows 7
推荐答案
你的问题的答案是:不，你不能那样做.
Microsoft 明确禁止此类行为.如果应用程序可以将自己添加到排除列表中，那么我们就会回到之前的混乱状态.
Microsoft specifically is forbidding such behavior. If a applications could add themselves to an exclude list, then we get back into the mess we had before.
您需要做的是让您的程序不需要管理权限.
What you need to do is make your program not require administrative access.
问问自己:您在 Windows XP 上做了什么?
- 我不允许运行你们的软件吗?
- 当我是标准用户时，您的软件会崩溃吗?
- 您的软件在由标准用户运行时没有提供任何价值，并且没有绝对没有功能吗?
Windows XP 没有 UAC 的说服力.用户以管理员身份运行程序的唯一方法是使用另一个用户登录.这比点击继续"的用户体验差得多.
Windows XP doesn't have the convince of the UAC. The only way for a user to run your program as an administrator is to logon with another user. And that's a much worse user experience than clicking "Continue".
如果您不想编写标准用户友好的软件，那么您就是问题的一部分.UAC 不是问题，UAC 是一种便利.我可以关闭 UAC，以标准用户的身份全职运行，而您的软件仍然无法运行.
If you don't want to write software that is standard user friendly, then you're part of the problem. UAC is not the problem, UAC is a convience. i can turn off UAC, run as a standard user full time, and your software still won't work.
- 白名单
- 记住我的偏好
- 别再问我了.
如果您有一个白名单，那么每个程序都会在安装时将自己添加到这样的列表中.
If you had a white-list, then every program would just add itself to such a list at install time.
如果存在这样的白名单，那么您的应用将成为恶意软件的目标.它很想修改二进制文件来执行它想要的东西；因为它知道程序将被静默提升.
If such a white-list existed, then your app would be the target of malware. It would love to modify the binary to execute what it wants; since it knows the program will be silently elevated.
恶意软件很想用 SendMessage 攻击您的应用程序，试图传递无效数据或结构，试图让您的管理应用程序执行它想要的代码.
Malware would love to poke at your application with SendMessage, trying to pass invalid data or structures, trying to get your, administrative, application to execute the code it wants.
如果用户可以选择禁用程序的未来提示，那么他们就会这样做，每个程序都将以管理员身份运行，我们将回到原来的状态.
If the user had the option to disable future prompts on programs, then they would just do it, and every program would run as an administrator, and we'll be back to the way things were.
所有这些想法都不能解决问题:几乎实际上没有程序需要管理权限.
All those ideas don't solve the problem: almost no program actually requires administrative access.
终于到了迫使开发人员接受这一事实的时候了.
The time has finally come to force developers to come to terms with that fact.
有些人想想办法让白名单发挥作用.
Some people want to come up with ways to make whitelists work.
有一个复选框，用户可以在其中说不再提示我输入此文件"
如果您存储该文件名，则其他同名程序将以管理员身份静默运行.
Have a checkbox where the user can say, "Don't prompt me for this file anymore"
If you store that filename, then other programs with the same name will silently run as administrators.
好的，那我们就记录下完整路径，或者使用文件的hash，作为白名单入口.如果有白名单，那么其他程序会在安装时将自己添加到该列表中，并让程序以用户不想要的管理权限运行.
Okay, then we'll record the full path, or use the hash of the file, as the whitelist entry. If there's a whitelist then other programs will add themselves to that list when they install, and have programs running with administrative access that the user didn't want.
如果只允许签名的应用程序，我们就知道它们是安全的. 应用程序不安全，因为它们已签名.一个应用程序不必是恶意软件，它就会被滥用来做坏事.(例如，flash、firefox(即 chrome、safari、opera、word、photoshop、Yahoo 图像上传工具)中的缓冲区溢出).
What if only signed applications are allowed, that way we know they're safe. Applications are not safe because they're signed. An application doesn't have to be malware for it to be abused into doing bad things. (e.g. buffer overruns in flash, firefox, ie, chrome, safari, opera, word, photoshop, Yahoo image uploader tool).
您必须将有效代码签名者的列表存储在 somehwere 列表中.而且无论您如何分割，拥有any白名单意味着应用程序只会将自己添加到该列表中.
You have to store list of valid code-signers in a list somehwere. And no matter how you slice it, having any white-list will mean that applications will just add themselves to that list.
- 好吧，那就不要让他们访问该列表.甚至管理员都不允许向列表中添加项目. 如果连管理员都不能向列表中添加项目，那么用户如何首先将项目添加到列表中?如果不允许将项目添加到白名单，则无法将项目添加到白名单！
- Well, then don't allow them access to the list. Not even administrators are allowed to add items to the list. If not even administrators can add items to the list, then how can the user add items to the list in the first place? You can't add items to the whitelist if you're not allowed to add items to the whitelist!
您如何管理白名单?假设用户改变了主意，或者爸爸改变了主意，或者 IT 改变了主意，或者公司改变了主意，或者软件发布者改变了主意:你如何从列表中删除项目 - 特别是当没有人时允许修改列表.
And how do you manage the white-list? Lets say the user has changed their mind, or Dad has changed his mind, or IT has changed its mind, or corporate has changed its mind, or the software publisher changes their mind: how do you remove items from the list - especially when nobody is allowd to modify the list.
总结:白名单不起作用.
这篇关于我们可以让 UAC 提示只显示一次吗?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
