UAC

Previously, DevInstall had posted an Event relating to Webcast from MSDN: Designing Application Installations for User Account Control with Windows Installer 4.0 in Windows Vista. If you missed the live Webcast which was on October 18, MSDN has now made that available on-demand.

What does the Webcast talk about? Some highlights?

1. User Account Control (UAC) in Vista and Windows Installer 4.0 Integration
2. Signing Your Package - some new dialogs
3. Credential Prompt-Free Patching
4. Adding the “Shield” to your User Interface
5. When does elevation happen?
6. Precautions when using AdminUser
7. A word about Custom Actions (CAs)
8. ALLUSERS Property Under UAC
9. Creating a True “Per-User” Package
10. Using a Setup.exe Bootstrapper
11. Testing your Package

In addition, the on-going Q/A session during the presentation was highly informational. Some highlights from the session:

…

Question: We don’t want to make the customer go through the UI and then abort in the Execute sequence if Privileged is False. What can we check in the UI sequence to abort?

Answer: The UAC credential prompt is a one way door. There is no way to tell in advance whether the user will approve the credential prompt. Once the credential prompt is approved you are running as administrator. This is a constraint of UAC.

…

Question: On Vista, is there a way to run an elevated install silentley? i.e: When using /qb Vista do shows the elevation dailog request - but also shows the progress bar. When using /qn - nothing happens … Is’nt a way of metigation between the two switches ??

Answer: The UAC functionality does not allow elevate silently. The recommendation from the UAC team is to 1) run from a managability tool such as SMS, Altiris, Tivoli, etc 2) run from an elevated command line 3) (for automated testing in development only) write a service that elevates a command line when passed.

…

Question: There’s some confusion about whether the “no impersonate” bit can be used in the UI sequence. Docs imply it only applies to deferred custom actions.

Answer: NoImpersonate can not be used in the UI Sequence or in the InstallExecuteSequence outside of the script. To have a custom action run inside the script, one needs to mark their custom action deferred.

…

Question: So where does ALLUSERS=2 bounce to?
Answer: ALLUSERS==1.

…

And many more?This is a strong recommendation to Application Developers, Installation Developers and also for Application Packagers. 

Presenter: Tyler Robinson, Lead Program Manager, Microsoft Corporation
Session Q/A: Robert Flaming, Program Manager, Microsoft Corporation

Watch this on-demand Webcast ||| Read the Full Session Chat Transcript

Windows Installer Team has also scheduled next similar webcast for October 30, 2006 Designing Software Installations for Windows Vista Using Windows Installer 4.0.

Additional Resources:
If you are more interested to learn about UAC in Vista and Windows Installer 4.0, Robert Flaming published a series of articles earlier: Understanding UAC in Vista and Windows Installer. Uday Shivaswamy’s earlier webcast about Modifying Your Applications to Run on Windows Vista is an additional support to understand in the sequence. There is also an upcoming event about 10 More Commandments for Software Packaging: Focus on Vista Migration, you may find it more helpful in the context.

The history of UAC, User Account Control, dates back to as early as Windows 95 Operating System. With the ‘intense’ requirement in the corporate world to have employees their own ‘user profile’, Microsoft implemented profiling concept many years earlier however reaching Windows Vista, the concept has taken a major and bold changes. Introduction of Windows Installer Technology and it’s continuing evolution makes UAC as one of the secure form of application installation and management services.

Robert Flaming, product manager at Windows Installer Team, has recently published a series of articles relating and concerning “User Account Control and Windows Installer”. His articles discusses some of the very important concepts that are MUST to understand to create applications in Windows Vista. Windows Installer 4.0 is the latest version available and currently only compatible with Windows Vista.

Flaming’s articles (ascending order):

Added October 01, 2006:

• UAC in MSI Notes: Answers to questions in comments from earlier blog posts.
• UAC in MSI Notes: What are the Hurdles in Windows Vista Logo compliance related to UAC and MSI?
• UAC in MSI Notes: How do I get one credential dialog for a multiple package install?
• UAC in MSI Notes: Easier for my current custom installer to support UAC than switch to MSI?
• UAC in MSI Notes: How to Build Packages that work for both Standard User and Per-Machine?
• UAC in MSI Notes: Is “this” intentional? If so, why?
• UAC in MSI Notes: Do I need to consider “this” when I’m designing for UAC in MSI? Generally, no.

Added September 30, 2006:

• UAC in MSI Notes: how do I troubleshoot UAC in MSI via the log?
• UAC in MSI Notes: How do I get the shield on the advertised shortcut?
• MSI in UAC Notes: When General Custom Action Mitigation Fails
• MSI in UAC Notes: Should I write my installer as a Standard User install? If yes, how?
• MSI in UAC Notes: Read the Friendly Manual

Earlier Posts:

• MSI in UAC Notes: O Whitepaper, Where Art Thou?
• UAC in MSI Notes: Challenges for a Beautiful Custom Action
• UAC in MSI Notes: My “Four Square” Diagram
• UAC in MSI Notes: The NoImpersonate Bit Mistake
• UAC in MSI Notes: Modifying System in InstallExecuteSequence outside of Script
• UAC in MSI Notes: Modify System with InstallUISequence Custom Action
• UAC in MSI Notes: The AdminUser Mistake
• UAC in MSI Notes: Credential Prompt and Permissions
• UAC in MSI Notes: The “Saw Tooth” Diagram
• UAC in MSI Notes: A Relief Providing Framework
• UAC in MSI Notes: Jagged Edge to User
• UAC in MSI Notes: Just Like Managed Installs
• UAC in MSI Notes: Conficting Definitions of Per-User
• UAC in MSI Notes: How I Root Cause The Problem
• UAC in MSI Notes: Introduction

These articles should be helpful and ‘may be’ the key discussions of forth coming Webcasts at MSDN about Designing Application Installations for UAC with Windows Installer 4.0 in Windows Vista scheduled on Wednesday, October 18, 2006 10:00AM Pacific Time. If you have any concerns reading these articles and would like to understand more about UAC features in Vista and ‘know-hows’, you can follow the link and register for the event.

NOTES
Robert Flaming is adding a series of articles in the same list once in a while. They will be updated here once available with update date stamp of this article.
Original Post: September 24, 2006
Edited Post: October 01, 2006