User Account Control Detection for Installations

By default Windows Vista attempts to detect application installations and will automatically prompt for elevation when you attempt to run an installation.

On your home computer (or any system not managed by remote software installation systems) this can be a very helpful capability. Without it, you would need to right click on any installation setup and choose “Run as administrator”. Even when you are logged on as an administrator UAC limits your actions to that of an unprivileged user. With no automatic prompt, installations would routinely fail due to insufficient access.

However, if you are in a corporate environment and you want to support application deployment using only tools like Group Policy and SMS you may wish to disable this behavior as it may be unnecessary (and potentially undesirable). To control if Vista will attempt to prompt for installations, you can configure the Security Policy “User Account Control: Detect application installations and prompt for elevation”. You’ll find this policy in Local Security Policy under:

Security Settings > Local Policies > Security Options

When enabled (the default), application installation packages that require an elevation of privilege to install will be detected and trigger the configured elevation prompt. Disabling this policy instructs Vista not to perform this installation detection and prompting.

One of the ways Vista tries to determine if an executable is an installation is by looking at the filename. If the executable name includes the word “setup” or “install” you’ll be prompted. In fact, even the characters “uninst” in an executable name can trigger this security prompt. This can lead to rare situation where you are prompted unnecessarily. The iTripoli Uninstall Wizard is an example of this. While it is actually a little tool for generating script code that will silently remove selected software, its file name is UninstallWizard.exe. Because the string “instal” is in the filename UAC prompts when the tool is launched though elevated permissions are not really necessary. You can see this behavior by renaming an executable to include “uinst” or “install”. When you do, you will see the security shield graphic appear in the lower right corner of the executable icon.

If you run an executable that prompts for this reason Windows Vista may ask you if everything ran okay. If nothing appears to have been installed by what was believed to be an installation, Vista asks you about it. The message reads, “This program might not have installed correctly. If this program didn’t install correctly, try reinstalling using settings that are compatible with this version of Windows.” You are then able to choose “Reinstall using recommended settings” or “This program installed correctly”. This is the Program Compatibility Assistant trying to do its work. Vista is smart like that. For more on the Program Compatibility Assistant, please see this article. http://www.realtime-vista.com/administration/2007/04/vista_program_compatibility_as.htm