"Program may need admin permissions"
lazarus / 67-Windows

----------------------------------------------------------------------
Ñuño_Martínez · 2017-01-11 12:56

Actually I'm not sure it is a problem with FPC but I need to find the
culprit.

I've found some programs I made works perfectly on Windows 7 64bit,
but when I close them a window appear saying that "This program may
need administrator privileges."* allowing me to restart the
application as administrator or label that program with a "This
program works perfectly".

AFAIK the programs are compiled with FPC 3.0.0 as 32bit (I tried to
build 64bit applications but it was impossible, is it?).  May be a
newer compiler would fix this?  Or may be it is because they're
running in 32bit?

May be the origin of the problem is the Allegro library I'm using?
_____________________________

* I'm Spanish so the message in English may be different than my
translation.

----------------------------------------------------------------------
Thaddy · 2017-01-11 13:00

No. Your problem is that you have to add a manifest resource.

----------------------------------------------------------------------
Ñuño_Martínez · 2017-01-11 13:04

That's new for me.  Is there a way to do it easily from command line
(e.g. makefile)?  I should investigate.  Is there a wiki page or
something?  A few searching doesn't find something useful (yet)...

----------------------------------------------------------------------
Thaddy · 2017-01-11 13:06

Quote from: Ñuño_Martínez on January 11, 2017, 02:04:22 pmThat's new
for me.  Is there a way to do it easily from command line (e.g.
makefile)?  I should investigate.  Is there a wiki page or something? 
A few searching doesn't find something useful (yet)...
Windows 7 and up and forced on windows 10:
Code: XML  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i <?xml
version="1.0" encoding="UTF-8" standalone="yes" ?><assembly
xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">   
<assemblyIdentity         version="1.0.0.0"       
 processorArchitecture="X86"         name="RoofGenius.RoofCalcWriter
10"        type="win32" />    <description>Executable</description>  
<dependency>        <dependentAssembly>            <assemblyIdentity
              type="win32"               
 name="Microsoft.Windows.Common-Controls"               
 version="6.0.0.0"                 processorArchitecture="X86"       
        publicKeyToken="6595b64144ccf1df"                 language="*"
/>        </dependentAssembly>    </dependency>    <!-- Identify the
application security requirements. -->    <ms_asmv2:trustInfo
xmlns:ms_asmv2="urn:schemas-microsoft-com:asm.v2">     
<ms_asmv2:security>        <ms_asmv2:requestedPrivileges>         
<ms_asmv2:requestedExecutionLevel            level="asInvoker"       
   uiAccess="false"/>          </ms_asmv2:requestedPrivileges>       
 </ms_asmv2:security>    </ms_asmv2:trustInfo></assembly>
See here for instructions:
http://stackoverflow.com/questions/14703013/adding-manifest-for-admin-
rights-request

----------------------------------------------------------------------
lainz · 2017-01-11 13:26

You must also add HighDPI stuff in the manifest if you don't want your
visual (Allegro) application look blurry on HighDPI settings. And
optional compatibility for each Windows OS.

manifest.xml

Code: XML  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i <?xml
version="1.0" encoding="utf-8"?><assembly manifestVersion="1.0"
xmlns="urn:schemas-microsoft-com:asm.v1">  <assemblyIdentity
version="1.0.0.0" name="title" />  <trustInfo xmlns="urn:schemas-
microsoft-com:asm.v2">    <security>      <requestedPrivileges
xmlns="urn:schemas-microsoft-com:asm.v3">       
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"
/>      </requestedPrivileges>    </security>  </trustInfo> 
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">   
<application>      <!-- Windows Vista -->      <supportedOS
Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" />      <!-- Windows 7
-->      <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /> 
   <!-- Windows 8 -->      <supportedOS
Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" />      <!-- Windows 8.1
-->      <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" /> 
   <!-- Windows 10 -->      <supportedOS
Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />    </application> 
</compatibility>  <application xmlns="urn:schemas-microsoft-
com:asm.v3">    <windowsSettings>      <dpiAware xmlns="http://schemas
.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>   
</windowsSettings>  </application>  <dependency>   
<dependentAssembly>      <assemblyIdentity          type="win32"     
   name="Microsoft.Windows.Common-Controls"          version="6.0.0.0"
         processorArchitecture="*"        
 publicKeyToken="6595b64144ccf1df"          language="*"        />   
</dependentAssembly>  </dependency></assembly>
manifest.rc

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i 1 24
"manifest.xml"

----------------------------------------------------------------------
Thaddy · 2017-01-11 13:40

Tnx for the addition and I should have stressed forced for windows
10.X.. For newly installed software only, for some reason. It leaves
existing programs to work after upgrading.
BTW: Your manifest should use AsInvoker..... That means that the
application has the same rights as the user that started it. I

----------------------------------------------------------------------
Ñuño_Martínez · 2017-01-11 15:54

Thank you.

After some testing (lainz manifest requests for administrator
privileges when executing), I have this manifest:
Code: XML  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i <?xml
version="1.0" encoding="utf-8"?><!-- Windows manifest.      Just as
discussed at    
http://forum.lazarus.freepascal.org/index.php/topic,35392.0.html    
You should include this in ALL your Allegro applications.
 --><assembly xmlns="urn:schemas-microsoft-com:asm.v1"
manifestVersion="1.0">    <assemblyIdentity       version="1.0.0.0"  
   processorArchitecture="X86"       name="RoofGenius.RoofCalcWriter
10"       type="win32" />    <description>Executable</description>   
<dependency>        <dependentAssembly>            <assemblyIdentity 
            type="win32"               name="Microsoft.Windows.Common-
Controls"               version="6.0.0.0"              
processorArchitecture="X86"              
publicKeyToken="6595b64144ccf1df"               language="*" />      
</dependentAssembly>    </dependency><!-- Identify the application
security requirements. -->    <ms_asmv2:trustInfo
xmlns:ms_asmv2="urn:schemas-microsoft-com:asm.v2">     
<ms_asmv2:security>        <ms_asmv2:requestedPrivileges>         
<ms_asmv2:requestedExecutionLevel             level="asInvoker"      
     uiAccess="false"/>        </ms_asmv2:requestedPrivileges>     
</ms_asmv2:security>    </ms_asmv2:trustInfo><!-- OS compatibility.
-->  <compatibility xmlns="urn:schemas-microsoft-
com:compatibility.v1">    <application>      <!-- Windows Vista -->  
  <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" />     
<!-- Windows 7 -->      <supportedOS
Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" />      <!-- Windows 8
-->      <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" /> 
   <!-- Windows 8.1 -->      <supportedOS
Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" />      <!-- Windows 10
-->      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" /> 
 </application>  </compatibility><!-- HighDPI, so visuals don't look
blurry on HighDPI settings. -->  <application xmlns="urn:schemas-
microsoft-com:asm.v3">    <windowsSettings>      <dpiAware xmlns="http
://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>   
</windowsSettings>  </application></assembly
Anyway I should do a few more tests to be sure it works (i.e. Windows
XP).  May be later I'll create a "Windows manifest" wiki page if
nobody else does it.

----------------------------------------------------------------------
Thaddy · 2017-01-11 16:42

Don't ever use AsAdministrator unless you ARE the administrator or the
user is intended to have administrator rights (which is global) ! Use
AsInvoker. I can't shout out how important that is.

If the user is allowed to run your program (as invoker, which simply
means he started it) it will run.

----------------------------------------------------------------------
lainz · 2017-01-11 17:00

If that's the case, I understand it wrong the first time, I think that
his application was needing administrator privileges, for that I
changed that line. But if only was the error message, the lack of
manifest, you do asInvoker.

----------------------------------------------------------------------
lainz · 2017-01-11 17:13

Quote from: Ñuño_Martínez on January 11, 2017, 04:54:59 pmAnyway I
should do a few more tests to be sure it works (i.e. Windows XP).  May
be later I'll create a "Windows manifest" wiki page if nobody else
does it.

The thing is that you can enable the manifest from the Project Options
already, even in command line applications.

----------------------------------------------------------------------
Ñuño_Martínez · 2017-01-11 19:34

I know, but I'm not using Lazarus here, just FPC and make.

So it looks fixed.  Thank you both.

----------------------------------------------------------------------
ASerge · 2017-01-11 20:32

Quote from: Ñuño_Martínez on January 11, 2017, 01:56:02 pmI've found
some programs I made works perfectly on Windows 7 64bit, but when I
close them a window appear saying that "This program may need
administrator privileges."* allowing me to restart the application as
administrator or label that program with a "This program works
perfectly".
"This program might require administrator privilege".
Windows treats a process as legacy if it’s 32-bit (versus 64-bit), is
not running with administrative rights, and does not have a manifest
file indicating that it was written for this version of Windows.
And your app is probably being detected as a setup. The Program
Compatability Assistant is probably looking for changes of the sort an
installer would make, and not seeing them, and is assuming that you
were trying to run a setup that is rejecting the current version of
windows or needs some sort of compatability fix to work.
As mentioned above, use the manifest.

----------------------------------------------------------------------
lainz · 2017-01-11 20:48

Quote from: ASerge on January 11, 2017, 09:32:12 pmQuote from:
Ñuño_Martínez on January 11, 2017, 01:56:02 pmI've found some programs
I made works perfectly on Windows 7 64bit, but when I close them a
window appear saying that "This program may need administrator
privileges."* allowing me to restart the application as administrator
or label that program with a "This program works perfectly".
"This program might require administrator privilege".
Windows treats a process as legacy if it’s 32-bit (versus 64-bit), is
not running with administrative rights, and does not have a manifest
file indicating that it was written for this version of Windows.
And your app is probably being detected as a setup. The Program
Compatability Assistant is probably looking for changes of the sort an
installer would make, and not seeing them, and is assuming that you
were trying to run a setup that is rejecting the current version of
windows or needs some sort of compatability fix to work.
As mentioned above, use the manifest.

Something like trying to write something in program files, accessing
the registry..

----------------------------------------------------------------------
Ñuño_Martínez · 2017-01-12 11:34

Quote from: ASerge on January 11, 2017, 09:32:12 pmQuote from:
Ñuño_Martínez on January 11, 2017, 01:56:02 pmI've found some programs
I made works perfectly on Windows 7 64bit, but when I close them a
window appear saying that "This program may need administrator
privileges."* allowing me to restart the application as administrator
or label that program with a "This program works perfectly".
"This program might require administrator privilege". Thanks for the
fix and the comment.

----------------------------------------------------------------------
ASerge · 2017-01-12 16:26

Quote from: lainz on January 11, 2017, 09:48:05 pmSomething like
trying to write something in program files, accessing the registry..
I think not in this case, because for legacy program used virtual
storage. If you have such programs, then in
%LOCALAPPDATA%\VirtualStore\ will be virtual "Program Files" and
"Windows" for they.

----------------------------------------------------------------------
lainz · 2017-01-12 17:43

Quote from: ASerge on January 12, 2017, 05:26:12 pmQuote from: lainz
on January 11, 2017, 09:48:05 pmSomething like trying to write
something in program files, accessing the registry..
I think not in this case, because for legacy program used virtual
storage. If you have such programs, then in
%LOCALAPPDATA%\VirtualStore\ will be virtual "Program Files" and
"Windows" for they.

That is for those programs with no manifest or with manifest with no
specific OS support? And from wich version of Windows?

Because I sometimes need to run as administrator some applications
that can't read/write to program files.

----------------------------------------------------------------------
ASerge · 2017-01-14 17:21

Quote from: lainz on January 12, 2017, 06:43:56 pmThat is for those
programs with no manifest or with manifest with no specific OS
support? And from wich version of Windows?
Better refer to the developer documentation. For example
https://msdn.microsoft.com/en-us/library/bb530198.aspx. And it can be
disabled: https://technet.microsoft.com/en-
us/library/dd835564%28WS.10%29.aspx#BKMK_Virtualize.

----------------------------------------------------------------------
lainz · 2017-01-14 19:17

Thankyou. Yes is what I think was happening, the manifest should not
include requestedExecutionLevel to be virtualized. Some of the
applications I tell has a manifest asInvoker, but should be executed
as administrator to work, that's the problem.