Question

So we have a java process that runs as a windows service. It needs to execute a command with Runtime.getRuntime().exec(command). The command it executes requires UAC. This is on windows server 2008 and sounds like you cannot disable UAC for a single executable so is there any other way to make this work?

Answer 1

If your Java application runs as a windows service, it most likely runs under one of the system accounts: SYSTEM (most probable), LOCAL SERVICE, or NETWORK SERVICE. Thus if the service runs under SYSTEM account, everything you start from the service will inherit the account. Anyway your service must be allowed to interact with Desktop.

To summarize, if your process run as elevated, then processes started from it will also run elevated.

---

To elevate, you have to use ShellExecute or ShellExecuteEx functions of Windows API. If the .exe you’re starting is marked with level=requireAdministrator in its manifest, the shell will display UAC dialog. If it’s not marked, you can use runas verb/operation to force UAC confirmation dialog. Note: runas on Windows XP will show “Run as another user” dialog.

If Runtime.getRuntime().exec(command) is implemented via ShellExecute, then marking the .exe with appropriate manifest will work; if exec uses CreateProcess, the process will be started with current user privileges, i.e. not elevated; moreover the process will not be started at all if .exe has requireAdministrator in its manifest.