7zip Self Extracting Archive (SFX) without administrator privileges

Question

I use 7zip to create the SFX as follows:

7z.exe a -r archive.7z *

Then I do a binary copy with the 7zS.sfx file (used to create a self extracting installer), config file "build.config", and the archive. The contents of config file are as follows:

;!@Install@!UTF-8!
RunProgram="setup.exe"
GUIMode="1"
Path="%tmp%\\mytemp"
;!@InstallEnd@!

Binary copy command is as follows:

copy /b 7zS.sfx + build.config + archive.7z sfxInstaller.exe

Problem is that the result SFX "sfxInstaller.exe" requires admin privileges for executing. Is it possible to generate Self Extracting Archives using 7-Zip that do not require admin privileges? If so, what parameters/command line arguments should I use? Thanks in advance.

score 8 · Accepted Answer · answered Jan 16 '19 at 07:56

I fixed this problem with mpursuit answer.

To update manifest of 7zS.sfx you can use the following procedure:

manifest.xml

   <?xml version="1.0" encoding="utf-8"?>
    <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">

      <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
        <application>
          <!--application support for Windows Vista -->
          <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
          <!--application support for Windows 7 -->
          <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
        </application>
      </compatibility>

      <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
        <security>
          <requestedPrivileges>
            <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
          </requestedPrivileges>
        </security>
      </trustInfo>

    </assembly>

call "C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\vcvarsall.bat" x86
mt.exe -manifest manifest.xml -outputresource:"7zS.sfx;#1"
copy /b 7zS.sfx + build.config + archive.7z sfx_archive.exe

It worked! I found `vcvarsall.bat` here: `C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Auxiliary\Build\vcvarsall.bat`. I used [7zSD.sfx](https://www.7-zip.org/sdk.html) instead of `7zS.sfx`. — browly, Oct 09 '19 at 16:10
I didn't find mt.exe in any of my Microsoft Visual Studio directories, but I did find it in: `Microsoft SDKs\Windows\v7.1\Bin` and `...\x64`, `Windows Kits\10\bin\10.0.17763.0\{arm64,x64,x86}`, and `Windows Kits\8.1\bin\{x64,x86}`. I used the one from `Windows Kits\8.1\x86` and it worked. I didn't seem to need vcvarsapp.bat. Thanks! — Jordan Brown, Jan 04 '20 at 21:46
The required manifest can also be easily added using Resource Hacker which is a popular windows application. — A.J., Aug 16 '21 at 09:06

score 2 · Answer 2 · answered Nov 26 '14 at 11:58

2

You can embed a manifest file in the original 7zs.sfx that informs Windows to run the extractor with the same access token as the parent process. Which will cause the self extractor to run as a normal user if that is what the user is login as.

The following link describes how to embed a manifest file in an executable using Visual Studio 2005, but the same process applies in later versions. https://support.microsoft.com/kb/944276

Once you have embedded the manifest file that sets the "requestedExecutionLevel" to "asInvoker", any self extracting archieve created in the normal way with the modified 7sz.sfx will not require administrator privileges.

answered Nov 26 '14 at 11:58

mpursuit

663
6
22

You can also modify the manifest of the sfx file using a simple hex editor. Just search for "requestedExecutionLevel" and you will find that it is followed by `level="highestAvailable"`. Just change it to `level="asInvoker" ` (using trailing spaces for the extra characters). I did this successfully with 7zSD.sfx. – J Higs Mar 23 '16 at 16:34
3

Could not find `requestedExecutionLevel`, `level` or `highestAvailable` in 7zSD.sfx (version 9.20, 18. nov 2010, md5sum fe5a4c1f2b3439653480c27a3958de15). – arve0 Apr 04 '17 at 14:51
@JHigs, can you create an answer that explains how you did this? – Kyle B Jul 13 '18 at 18:55
2

I downloaded the 9.2 version of 7zSD.sfx today and it is different than the version I have. Like you said, it does not have `level="highestAvailable"` in it. I found this link to a version of the file that already has the `level="asInvoker"` in it: https://github.com/github/ghfw-build-extra/blob/master/7-Zip/7zSD.sfx – J Higs Jul 19 '18 at 13:53

score 1 · Answer 3 · answered Oct 10 '13 at 11:05

1

Unfortunately I have not found a way to generate SFXs using 7zip that do not require admin privileges. Having tried some other SFX generators, I stopped at IExpress that has completely satisfied my needs.

answered Oct 10 '13 at 11:05

Ruslan Gilmutdinov

1,217
2
9
20

score 1 · Answer 4 · edited Jan 18 '15 at 06:23

1

Put MiscFlags="4" in your config file. That should fix your problem.

It should look like this:

;!@Install@!UTF-8!
RunProgram="setup.exe"
GUIMode="1"
Path="%tmp%\\mytemp"
MiscFlags="4"
;!@InstallEnd@!

edited Jan 18 '15 at 06:23

Nathan Tuggy

2,237
27
30
38

answered Jan 18 '15 at 05:49

Abdul Mujeeb D. Ali

19
1

3

This did not work with Windows 10, 7zS.sfx/7zSD.sfx, version 9.20, 18. nov 2010. – arve0 Apr 04 '17 at 14:55
2

I think `MiscFlags="4"` is supposed to *elevate* to Administrator – Kyle B Jul 13 '18 at 18:53

score 1 · Answer 5 · answered Feb 13 '19 at 12:58

I don't understand how MiscFlags="4" can solve the problem.

What is the reason of the problem? You use copy /b 7zS.sfx (or 7zS2, or 7zSD, doesn't matter) with your files and it will get you a file with permissions to run only as administrator. The information what role (admin, simple user) can run the application is stored in manifest inside the application. 7zS (or 7zS2, or 7zSD) doesn't have manifest. So if you use Windows Vista or further, the result file will prompt you to enter admin credentials.

This article will help you. Read from "Getting Rid of UAC Prompt".

https://www.excelsiorjet.com/kb/35/howto-create-a-single-exe-from-your-java-application

You can fix the problem using resource editor software such as ResEdit. You should add a manifest to the 7zS.sfx file with the security information:

<security>
  <requestedPrivileges>
    <requestedExecutionLevel
      level="asInvoker"
      uiAccess="false"/>
  </requestedPrivileges>
</security>

score 0 · Answer 6 · answered Apr 18 '14 at 08:49

0

You can use 7zsd.sfx instead of 7zs.sfx. This will not require admin privileges.

answered Apr 18 '14 at 08:49

k6thik

17
7

5

When Windows 7 with 7-Zip 9.20, I found extractors created with 7zSD.sfx still required admin privileges. – mpursuit Nov 26 '14 at 11:48

score 0 · Answer 7 · answered May 11 '22 at 11:40

it worked fine thanks for the help but I used call "C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\vcvarsall.bat" x86 mt.exe -manifest manifest.xml -outputresource:"7zSD.sfx;#1" copy /b 7zSD.sfx + config.txt + techselfsupport.7z techselfsupport.exe

7zip Self Extracting Archive (SFX) without administrator privileges

7 Answers7

Linked