How to Launch an Exe at User Level from a Higher Level

Question

I would like a process to always run at the user level. Either when it is launched by the installer (custom, not msi), which runs as at the administrator level, or when a user logs on. Looking around, I'm not sure this is possible.

Answer 1

Everybody is always looking for going around the other way. Anyhoo, this code project should help.

Answer 2

Assuming you know which user you want to run as, and have their password, the CreateProcessWithLogonW Function will do that.

Answer 3

There are many hacky ways to do this (Use the taskscheduler, inject into explorer.exe etc)

The only way to get the correct user (The one that started your program before UAC elevation (This might not be the same user as the shell/"login"/"session owner")) is to have the installer run two instances of itself, one "outer" instance that is not elevated, it mostly just starts the other instance by starting itself with ShellExecute[Ex] with the runas verb. When it comes time to start the medium/low level process, the elevated instance by some form of IPC tells the outer instance to start the new process.

It is a pain in the neck to implement, I would recommend just not having a run checkbox at the end of your installer.

Answer 4

similar to what Bill said, you can also use CreateProcessAsUser() API to do that.

1. First use LogonUser() and get an access token for the user that the process needs to run as . Here if the user belongs to administrators group (then you will get a split token if you pass the LOGON_FLAG as LOGON32_LOGON_INTERACTIVE). So if you need the elevated administrator token pass the flag as LOGON32_LOGON_BATCH.
2. With the token obtained above, you can call CreateProcessAsUser() passing the commandline and parameters.