How to make your MFC application bypass UAC in windows7 and Vista

Question

I have an MFC application developed in VS Studio 2008 which reads and writes to a JSON file in its installation folder. It works perfectly in vista(administrator) BUT ONLY when UAC is turned off. When UAC is ON, the application isn't able to write to its JSON file. I figured I had to create a manifest file but I haven't really tried creating one.

Questions:

1. reference: http://msdn.microsoft.com/en-us/library/bb384691.aspx. It says here that you can simply set the linker options in the Visual Studio development environment. What values do I need to select for:
   a) Enable User Account Control (UAC)? [I tried NO].

   b) UAC Execution Level? [I tried highestAvailable].

   c) and UAC Bypass UI Protection? [I tried Yes].

2. Do I need to add the manifest file in the software package (exe, Dll's, etc.)?

Thanks...

Solution 1

The whole concept of UAC is that you can not bypass it. If you could, it would be useless.

The only solution (which is what you should do anyway, not just because of UAC) is to never ever write files in the install folder but in %APPDATA% where it belongs.

Solution 2

You should copy this file to AppData. Modifying a file in Program Files will always trigger a UAC prompt. This operation requires admin privileges and manifest won't help you with that.

Solution 3

Adding manifest file you can only declare that the application needs UAC permisison. This way the user will be prompted for UAC on application start.

If this is what you want here you can find description how to do it.

Other aprroach is to install a service which runs with LocalSystem account and is allowed to do (almost) anything without asking for UAC permission. For this to work you have to implement inter process communication between your UI applicaiton and the service. Kernel objects shared between processes have to be created from the service with appropriate security attributes in order to be accessed form not elevated programs. The installation of the service will prompt the user for UAC ( as most other installations )

Comments

[man]

I'm extremely late for this but it is possible to bypass: github.com/hfiref0x/UACME