-3

I need to prevent installation if Login User account is limited. PrivilegesRequired key is not what I am looking for. it's value already defined as "admin" by default. so that variable has nothing to do with my question. I don't want to install even windows asks for admin password is correct. simply I want to totally prevent installation if logined account is not have administrator privilages.

no option for "Run only if current user is an Admin account" ?

Zen Of Kursat
  • 2,672
  • 1
  • 31
  • 47
  • Doesn't the administrator credentials prompt prevent the installation by users without administrator privileges? – Martin Prikryl Jun 24 '20 at 10:53
  • Yes, windows asks the administrator credentials prompt. but that is not what I want. there is an option in "advanced installer" totally prevents installation if Logined User Account has no Admin Rights. and that functionality is what I am looking for. so it seems that is not possible in inno. so it possible to write my own dll that returns true/false to innosetup so setup will exit or stop continue ? – Zen Of Kursat Jun 24 '20 at 10:56
  • You didn't really answer my question. – Martin Prikryl Jun 24 '20 at 10:58
  • it prompts. and if you enter admin password, setup continues to install in Limited User Account. it shouldn't ask. simply it should stop continue without asking "administrator credentials prompt" . I wanna check if "Logined" user is limited or not. if limited, it should stop continue without asking any credentials prompt. so is there a way to define that functionality as a my own dll that I can embed into installation ? – Zen Of Kursat Jun 24 '20 at 11:13
  • 1
    The installer runs the the account whose privileges you enter. Not for the original limited account. – Martin Prikryl Jun 24 '20 at 11:24
  • it shouldn't. it should stop continue without asking admin credentials password.. thats what I am looking for. – Zen Of Kursat Jun 24 '20 at 12:27
  • 1
    "I don't want to install even windows asks for admin password is correct" -- why? – Bill_Stewart Jun 24 '20 at 14:32
  • yeap, that's the point. its because my app doesn't work as expected under limited windows account even installation and main exe has administator privilages. ... somehow all functions returns true if executable runs as admin. executing an app as admin doesn't mean, logined user is admin. APIs or known functions just doesn't checks if logined user is admin or not. that's confusing. it seems lack of Windows Developers' logical problem. – Zen Of Kursat Jun 24 '20 at 14:58
  • somehow Advanced installer can detect as expected regardless if exe is run as admin or not. I built a dll and tried different functions. all not looks to logined account but looks if exe is run as admin or not. – Zen Of Kursat Jun 24 '20 at 15:01
  • 1
    This all looks like [XY problem](https://meta.stackexchange.com/q/66377/218578) to me. Your are solving a wrong problem. – Martin Prikryl Jun 24 '20 at 15:02
  • 1
    "its because my app doesn't work as expected under limited windows account even installation and main exe has administator privilages [sic]" -- this would seem to be a problem with your application, not the installer. (I agree with Martin that you seem to be trying to solve the wrong problem.) – Bill_Stewart Jun 24 '20 at 18:08
  • I ended up adding a label "Do not install under standard/limited user accounts". simple solution. (btw,... App uses compiled driver dlls that does not work as expected under limited users so I cannot remove / modify.).. I found the solution via dll that checks "domain name" not the "user name" or similar. getting username always sends the user who executes the exe. not default logined account. filtering "net localgroup administrators" and checking with "current domain name" seems the solution. I built an extra dll for inno seems working. will clean codes & post in the coming days after tests. – Zen Of Kursat Jun 24 '20 at 19:46
  • 1
    `PrivilegesRequires=lowest` forces non administrative installation mode. Per the documentation: "Do not use this setting unless you are sure your installation will run successfully on unprivileged accounts." – Bill_Stewart Jun 24 '20 at 21:52
  • 1
    I still do not understand your problem. If the installer is executed from a session of a non-administrator account and the installer has `PrivilegesRequires=admin`, UAC prompt will display. The installer will proceed only if Administrator credentials are provided. And the installer will run **as administrator**. The original "limited" account has no effect on the installation process. If your installer does not work, you have done something wrong. Ask a question about that problem, rather trying to workaround it. – Martin Prikryl Jun 25 '20 at 06:31
  • solved.. question was simple. "I wanted installation runs only if admin is already logined. I don't want windows interrupts and asks for an admin password. I made a dll. integrated into setup. that checks existing logon username is an already loginned admin via filtering "net localgroup administrators". in conclusion.. solved. will post soon. I know that is not a usual question but nobody have to think same as others. it looks like when you need pizza ppl refers you to eat taco. – Zen Of Kursat Jun 26 '20 at 09:14
  • 1
    The explanation still makes no sense to me. Why does it matter if setup prompts for administrator credentials? If you don't provide credentials, setup doesn't continue (it can't!). If you do provide valid credentials, then setup installs _as the user for which you provided the credentials_ (not the logged on user). – Bill_Stewart Jun 26 '20 at 17:13
  • that option already exists in "advanced installer". when you check on "require administrator account" windows doesn't ask an admin password and it simply throws error and quits. what if limited user knows password?. setup will continue. it should not. btw, human brain itself, doesn't like unusual situations and as a compiler each problem should be paired with a solve. after human-brain build that pair, its hard to seperate coupled elements to make new pairs. but, lifeworks as an interpreter not a compiler. everything is regularly changing and fixed ideas cannot continue persist to live on. – Zen Of Kursat Jun 27 '20 at 06:29
  • 1
    "that option already exists in 'advanced installer'. when you check on "require administrator account" windows doesn't ask an admin password and it simply throws error and quits." You could use "Run as administrator" to run it and it would do the same as what IS does. What problem does this solve? – Bill_Stewart Jun 27 '20 at 15:00
  • sorry. advanced installer option its name is not "require admininstrator account". it is "Run only if current user is an admin account". its not points same terminology. and yes I double checked, you cannot install by double clicking. but executing installer via tricky right mouse click "run as admin" it asks admin credentials. double click prevenst install and does not ask admin credentials therewithal. – Zen Of Kursat Jun 30 '20 at 22:04
  • You still haven't answered the question of what actual problem you're trying to solve. What difference does it make if Inno Setup requests administrative credentials? Specifically, what problem are you trying to solve by preventing it from doing so? – Bill_Stewart Jul 01 '20 at 00:56

3 Answers3

1

It's difficult to implement. The UAC prompt is shown by OS even before the installer is actually started. But you need the UAC prompt to get the Administrator privileges, even if the installer is executed by the Administrator. So you cannot really get rid of it.

You would have to use PrivilegesRequired=lowest to turn off the UAC prompt. Then test if the current user in a member of Administrator group (that might need a separate question).

If the user is not Administrator, display a message and exit. If the user is Administrator, restart the installer with UAC prompt. For a way to implement this part, see the second part of my answer to:
Make Inno Setup installer request privileges elevation only when needed

Overall, I think it way too much work for something that I do not believe is worth it.

Martin Prikryl
  • 188,800
  • 56
  • 490
  • 992
0

as Martin pointed me what I should focus on, I understood the problem. windows should not ask me the credentals. it should stop asking. and PrivilegesRequired=lowest does it. but this time, installer stops modifications in environment varaibles etc. the codes below is not the answer but I think it may help someone. "PrivilegesRequired=lowest" totally disables installer acces to environment variables and so. that made problemmatic results. I will solve the problem with creating an extra dll and will share here soon.

;relevant. but not the right answer
[Setup]
PrivilegesRequired=lowest
.
.
.
[Code]
//IsAdminLoggedOn or isAdmin 
//not checks Current user Account Type if you run install as admin 

function InitializeSetup(): Boolean;
begin
 Result:=True;
 if not (isAdmin) then // isAdmin built-in inno function...
 begin
    MsgBox('The installation needs administrator account.', mbInformation, MB_OK);
    Result := False;
 end;
Zen Of Kursat
  • 2,672
  • 1
  • 31
  • 47
  • 1
    `IsAdmin` does not tell you if the user is admin. It tells you if the installer runs with administrator privileges. With `PrivilegesRequired=lowest`, the installer will never run with administrator privileges, unless explicitly executed by Administrator using *"Run as administrator"* command. – Martin Prikryl Jun 24 '20 at 13:37
  • "windows should not ask me the credentals": Why not? What problem does it solve if you prevent the credential prompt? – Bill_Stewart Jun 29 '20 at 21:33
  • think that, you have 2 user accounts. you logined to limited/standard account. and therefore you know the admin pass. when you attempt to install. windows will ask one of the admin pass. and you enter it. and voila app is installed in a limited windows account. – Zen Of Kursat Jun 30 '20 at 21:31
  • No, that's not what happens. If you are logged on using an account that's not a member of `Administrators` and you request admin, the install runs _as the admin user_, not the logged on account. – Bill_Stewart Jul 01 '20 at 00:59
0

Question: "How to prevent installation to limited windows user account?"

Answer: Use PrivilegesRequired=admin in your [Setup] section.

From the documentation:

Valid values: admin, or lowest

Default value: admin

Description:
This directive affects whether elevated rights are requested (via a User Account Control dialog) when the installation is started.

When set to admin (the default), Setup will always run with administrative privileges and in administrative install mode. If Setup was started by an unprivileged user, Windows will ask for the password to an account that has administrative privileges, and Setup will then run under that account.

When set to lowest, Setup will not request to be run with administrative privileges even if it was started by a member of the Administrators group and will always run in non administrative install mode. Do not use this setting unless you are sure your installation will run successfully on unprivileged accounts.

Bill_Stewart
  • 22,916
  • 4
  • 51
  • 62