12

I'm using D2010 under Windows 7 to write an app that seems to require admin rights (I think because it uses COM to communicate with a third party .exe, which also requires admin rights).

I've added the manifest resource as required, but when I try to debug the app from the IDE, it reports

"Unable to create process. The requested operation requires elevation"

...and it won't run. If I run Delphi as administrator, then my app runs correctly, but this feels like a dangerous brute force approach, especially as most of the apps I develop don't need admin privileges.

Is there any way of getting Delphi to prompt for elevation just when I run my app, rather than having the whole IDE run elevated?

Kate Gregory
  • 18,808
  • 8
  • 56
  • 85
Roddy
  • 66,617
  • 42
  • 165
  • 277

5 Answers5

15

UAC also catches any application that has the words "setup", "update" or "install" in their name or in many of the Version Resource fields. (Company name, App Name, Description etc. It considers any such application to be a potential "installer" application and therefore must be run with Admin privileges.

Sounds crazy, but it's true. See the "Installer Detection" section in this document.

You can get around this by including a manifest that says that it doesn't need admin privileges.

Abdul Rahman
  • 2,097
  • 4
  • 28
  • 36
Phil Rogers
  • 545
  • 4
  • 11
  • 2
    Welcome to StackOverflow, @Phil. Did you actually read the question? your answer looks unrelated to what's being asked. – jachguate Nov 13 '12 at 16:08
  • I see your point. I was adding related information about UAC as somebody had brought up that subject. It doesn't actually nswer the question. Apologies. – Phil Rogers Jul 29 '13 at 11:26
  • don't apologize, this is a good answer, for a very different question. SO idea is to have specific answers to specific questions, so to accumulate "related stuff" is not really the goal here and we have google to do that anyway ;) – jachguate Jul 29 '13 at 18:39
  • This is just plain stupid. I had the same problem, just out of the blue it started to require elevation. Changed the name from Updater.exe to Yoo.exe and it started without any problems. :P – Max Kielland Mar 07 '15 at 09:27
  • Although not answering the question, the answer is adjacent to the topic and I found it extremely useful as a side info, as I did not know this UAC convention while spending 1h trying to find out why my app requires elevated privileges although it's not doing anything special and it's not configured for elevated privileges. – Alex Tuduran Mar 21 '22 at 10:18
10

There is none, it also doesn't work for VS:

https://stackoverflow.com/questions/3265787/how-do-i-debug-an-process-as-elevated-with-visual-studio-2008-sp1-on-windows-7

I guess you could run the remote debugger elevated and attach the IDE using remote debugging though.

It doesn't work, because the process is running as another user (or using another user token).

The IDE is trying to run the debugging process using CreateProcess and that fails when the application requires elavation, more details can be found in this article:

http://www.codeproject.com/KB/vista-security/UAC__The_Definitive_Guide.aspx

RAD Studio could run the application using ShellExecute with the "runas" verb, but this still doesn't solve the "debugging process under other user context" issue.

In other words: An elevated process can only be debugged by an elavated debugger.

Edit:

The Delphi XE2 IDE is 32-Bit and can debug 64-Bit applications only through the remote debugger (which is cleverly hidden from the user).

I guess Embarcadero could make it possible to debug elevated applications in a similar fashion.

Community
  • 1
  • 1
Jens Mühlenhoff
  • 14,565
  • 6
  • 56
  • 113
  • I don't understand this answer. As I read it you are stating that even when the IDE runs elevated, it can't debug a process with a requiredAdministrator manifest. Am I understanding you correctly? I don't think I can be understanding you correctly because that statement is false. – David Heffernan May 24 '11 at 15:05
  • 1
    @David: I said **the debugging applicaton** could be elevated _by_ the IDE, but then the IDE still can't attach to the application. I edited the corresponding sentence to clarify. – Jens Mühlenhoff May 24 '11 at 15:45
  • 2
    So your answer can be boiled down to "An elevated process can only be debugged by an elevated debugger"? Is that correct? – David Heffernan May 24 '11 at 22:11
  • @David: Exactly. I've added your statement to the answer. – Jens Mühlenhoff May 25 '11 at 09:27
6

The only way I know to debug such an app is to run the IDE as administrator. I wouldn't recommend doing this routinely, just for debugging sessions.

David Heffernan
  • 601,492
  • 42
  • 1,072
  • 1,490
  • If practicable you should also split the application into two separate parts: One that runs as a normal "AsInvoker" process and one that requires elevation. You should then add "the UAC shield" to buttons that start the other process, this is how UAC should be implemented. You would then only have to elevate the IDE to debug the "RequireAdministrator" process. – Jens Mühlenhoff May 25 '11 at 09:35
2

Run Delphi (any version) as Administrator.

You can change Delphi shortcut properties also (to run it always as administrator).

David Heffernan
  • 601,492
  • 42
  • 1,072
  • 1,490
Suat HD
  • 21
  • 1
1

Actually it may be possible to debug a process with "higher level access" from a process with "normal level access".

At least until Windows XP it is sufficient to add your user account to the Debugger Users group to debug processes running e.g. with Administrator privileges.

That doesn't solve Delphi 2010s problem to run the process at all, but may be useful if you try to attach the debugger to a already running process.

I don't think this works on UAC enabled Vista+, but I thought I'd mention it anyway. :)

To be exact the UAC split token concept disables the SeDebugPrivilege:

http://blogs.msdn.com/b/greggm/archive/2006/03/30/565303.aspx

http://blogs.msdn.com/b/mithuns/archive/2006/04/04/568291.aspx

Jens Mühlenhoff
  • 14,565
  • 6
  • 56
  • 113