Question

I have written a WPF application.
When it is installed on client machines, they are prompted for a username and password so that they have administrator privileges to use the application.

I need administrator privileges because my application opens ports and writes files to the file system.

Is it possible to allow any user to run the application without being prompted for an administrator username and password and to elevate the application to run with administrator privleges?

Thanks

Answer 1

When your app is installed, it will prompt for admin rights if the installation program has been marked for admin execution. This is normally only required if you want to install to a location available to multiple users, such as within the Program Files folder hierarchy. An MSI will raise a UAC prompt by default, but it’s easy to make an MSI with WIX that doesn’t raise a UAC prompt.

When your app is run (by a user without admin rights), it will ask for admin rights if the app itself has been marked for admin execution. This is partly under your control, but can overridden by users on the client machine.

An app that writes to file system folders doesn’t require admin rights as long as the user running the app has permission to those folders. Generally you can make this work by writing to a location that’s accessible to each user.

However, I believe that opening a port does need admin rights if the app is doing anything more than querying statistical information.

If your app does need admin rights to run, and you don’t want your non-admin users to see a UAC prompt during program execution, then I suggest you divide your app into 2 parts.

The first part is a Windows service that runs under a privileged user such as LocalSystem and is configured to interact with desktop programs. This service does all of the admin-related tasks, and will need to be setup by an installer that requests admin rights.

The second part is the WPF program that doesn’t do anything privileged. If you mark this WPF program as not needing elevation, your end-users will never see a UAC prompt when running it, because all the privileged work is being done by a service that’s always running.