How to make application run as admin on user accounts?

Question

Is it possible to make a .NET application always an admin while being run on a user account without a UAC popup? I've spent some time searching for this capability but haven't found any satisfactory answers.

For some background info, users are running a test application in a manufacturing environment where a dongle is plugged into a USB(to serial) port. Sometimes windows messes up the COM port and cycling the port can resolve the issue. We have discovered we can do this programmatically with admin privileges, but we do not want the users to be admins, and we also don't want the users to deal with a UAC popup or, god forbid, click "no" on the UAC popup to disable our capabilities and mess up the entire process.

How do I force my .NET application to run as administrator? I have found this old thread but their solutions all require the user to be admin or the usual UAC popup.

Is there something we can do to enable this capability or are we forever chained to the UAC prompt? We do own these machines and control the applications and users running on them.

EDIT: We are cycling the COM port using this method:

string ComPortName { get; set; } = "USB Serial Port (COM12)";
 

    private void button1_Click(object sender, EventArgs e)
    {
        SelectQuery query = new SelectQuery("Win32_PnPEntity", "Name=" + '"' + ComPortName + '"');
        ManagementObjectSearcher myDevices = new ManagementObjectSearcher(query);

        foreach (ManagementObject item in myDevices.Get())
        {
            textBox1.AppendText("Disabling port " + ComPortName + Environment.NewLine);
            ManagementBaseObject inParams = item.InvokeMethod("Disable", null, null);
            Thread.Sleep(3000);
            textBox1.AppendText("Enabling port " + ComPortName + Environment.NewLine);
            ManagementBaseObject UWFEnable = item.InvokeMethod("Enable", null, null);
            Thread.Sleep(3000);
            textBox1.AppendText("Finished cycling port " + ComPortName);
        }
    }

Answer 1

You can't, not without at least an UAC prompt. This is totally unavoidable, otherwise Windows wouldn't have any security if it was possible - it MUST be totally impossible, not just "difficult", to bypass UAC.

Some clues to solve anyway your problem:

• You can force your application to always ask for elevation (i.e. make it to require administrative privileges) since the first step. Dangerous, but at least, you won't mess the whole software chain: it would be elevated from start.
• You can ask for UAC only when it's really needed (for example, when launching a particular sub-process, or launching your own application in elevated mode while keeping context). Obviously, you'll ask again and again until the elevated subprocess is created: if user click on "No", then you try again to launch it. Annoying, but again, you won't mess up the whole process.
• You can write a Windows service, that will run under administrative privileges, to perform the COM cycle task you need. Then, you can invoke this service from non-elevated user space, without requiring any elevation. I would recommend this solution.

Answer 2

No, you cannot.

Imagine the user is a standard user - e.g. a 5 year old daughter

She cannot just become an administrator.

If anyone could just become an administrator - then there's no point in having security. And Windows NT is a secure operating system.

Solution to your problem

The easiest way to solve your problem is to grant Everyone permission to do the thing. Because in order to do it: someone needs permission.

We have discovered we can do this programmatically with admin privileges

You don't mention what actions you are taking programmatically, or what Windows API you're calling.

• If it involves a registry key, or file, or service
• Grant Modify permission
• to the Users group (or the Everyone group if you prefer)

This way the user's then have permission to do these things.

There's no shame in granting your users permissions to do the thing - it's what you want them to do. They should have permissions to do it.

If you care about defense-in-depth, you could follow the priciple of least privilege, and rather than granting everyone permission to do the thing, you can grant it to one user:

• the user that a service runs as
• the user that a scheduled task runs as

And then you only need to worry about your program communicating with a service (asking it to do the thing), or trigger the scheduled task (so that it can do the thing).

This way it's only the service/task that has permissions - and you grant that service/task the Modify permission on the thing that your standard users are currently denied from.

Imagine Windows XP

Imagine how you would have solved this before UAC:

• the user is a standard user
• and there is no UAC convenience feature to help them elevate to an administrator

In that case you would have to do one of the above:

• grant everyone permission to the registry key, or folder
• create a service or scheduled task that does have permission: and have your program ask them to do it