(Updated 5/10/2012 – I originally claimed that it was “trivial” to make a ClickOnce app require elevation – a commenter pointed out that ClickOnce does not support the requireAdministrator execution level at all. This does not let the vendor off the hook – they should not have used ClickOnce to deploy software that requires features ClickOnce does not support… FYI – there are workarounds from the deployment side)
One of our vendors distributes a couple tools as ClickOnce applications, but these applications perform privileged tasks that do not work with UAC enabled. A ClickOnce application cannot be elevated, nor can it be specified that it requires elevation, so the only way this application would have ever passed testing is if UAC was disabled on the developers’ machines, or Visual Studio is run as administrator)
Rant: UAC has been around since Windows Vista was released in 2006. As of this writing, that would be 6 years. Windows 7 has been out for 3 years. As much as some people might dislike the extra dialogs, UAC is a very good thing, and should not be disabled. There is no excuse for applications that do not handle UAC correctly. Adding the appropriate application manifest is not difficult,
and when using ClickOnce it is practically trivial (5/10/2012: Errata: ClickOnce Doesn’t support UAC – I was thinking about Full Trust) and if an application requires elevation it should be distributed standalone or with an MSI setup project.
Don’t use ClickOnce for applications that require elevation; Add the Application Manifest with a setup project to require elevation; or better yet modify your app to not require elevation at all, but do not just pretend it doesn’t exist. 6 years… come on!
Ok, now that my rant is out of the way, if you are in a similar situation – a ClickOnce app that needs elevation to run
, but doesn’t request it is a real pain in the butt.
if you try to create a shortcut to the app you will have the same problem. If you try to open the raw .appref-ms file, notepad automatically gives you the contents of the executable… It’s a bloody mess.
The (simple) solution requires both a batch file and a shortcut.
- Right Click on the ClickOnce shortcut, and select Properties. Copy the content of the location field and paste into notepad.
Add the trailing slash, and paste (or type) the filename (in this case “GoSyncUpdater”) followed by “.appref-ms”
eg: “C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Company Name\GoSyncUpdater.appref-ms”
Finally surround this with quotes, and save the file as a .bat file (e.g. runasadmin.bat)
At this point, you can right-click on the batch file, and you will have the option to “Run as Administrator” – If this is all you need you are done.
However, if you go to the Compatibility property tab to make the elevation required, the Privilege Level is disabled / grayed out…
- Create a shortcut to your batch file.
(You will notice that the Compatibility tab is similarly useless)
- Edit the properties, Under the Shortcut tab Click “Advanced…”
- OK out of the dialogs.
You now have a shortcut to a batch file that runs a shortcut to an executable. Convoluted, but it works. (The reason we don’t just make a shortcut to the executable directly is that the path will change when it is upgraded)
If you know of a better way, feel free to share.