Solved How to give permanent UACS permission to an application?

Hi

Sorry to ask an obvious question but... how can I give a specific program PERMANENT permission to run?

e.g. I still use a (very light and fast) desktop search utility called "Everything". It JUST searches filenames, and this is sometimes very useful.

I don't want to turn off my User Account Control Setting (UACS) completely because I want it to stop anything that I haven't given permission to from running. But it's incredibly irritating that every single time I open my "Everything" application that I am have to give it permission to run.

Many thanks

J

P.S. What is worse is that Everything tries to spider my disk at start up and so every time I reboot it needs permission to run. Nightmare! Fwiw, I never had that problem in Win7...

PPS. Btw, where can I find (and stop) which application are being loaded at startup?

Hello J,

You could use either tutorial to have a program run elevated without getting or turning off the UAC prompt to do so.
The tutorial below can help show you how to find your startup items to be able to disable or delete them.
Hope this helps.

Sounds promising thanks. Meanwhile I seem to have managed to avoid the immediate problem by installing a more recent (beta) version of Everything. If there are significant bugs I shall of course have to uninstall it.
Cheers

You're welcome. Hopefully the new version will work fine for you.

OK I've now had a LONG HARD look at this.

I know you are only trying to help but this is INTENSELY irritating.

1. I can't bl**dy believe how complicated all that is. SURELY that is not Micro$oft wanted us users to do!

2. It only works for a shortcut, and not when the application (e.g. an image or document viewer) is opened automatically.

3. There HAS to be a better way! For one thing, many applications open quite cheerfully without the UAC moaning. I have a new Samsung laptop. If I open "Quickstarter" there is no problem. But if I open "HelpDesk or "Support Center" I have to confirm the damned thing. WTF?

4. What is the difference between the two links you provide?

Elevated Program Shortcut without UAC Prompt - Create - Windows 7 Help Forums
Elevated Program Shortcut - Create for Standard User - Windows 7 Help Forums

5. Some of what you describe in the links has changed for Windows 8. i.e Your process doesnt work. (Something had changed its name I think...)

6. I went right through that entire process (I cant now remember which of the two processes which I cite in "4." I used but I think the first of the two) for an image opening program. I even changed the icon on the shortcut. It all worked when I was logged in as Administrator, but when I logged in as the user in question it failed to open! Nightmare. So then I tried to re-create the shortcut when still logged in my normal user (which FWIW has Administrator rights I think) but schtask failed to find the thing ("task"?) that I had created. Nightmare again.

What the heck are Microsoft playing at? Why is this so damned hard?
To be honest I think the only answer is to lower the security levels because I dont want this level of pain for every single application.
WTF?

P.S. I am running Windows 8 Pro (x64)

PPS. I opened up my Credential Manager, then clicked on Windows Credentials but it says there are "No Windows Credentials". So I tried logging in as Administrator and doing the same thing, but again it still says "No Windows credentials".

Nar, it's the same in Windows 8. By default, Windows will not run anything elevated at startup for security purposes since it will have full access to everything on the PC. That's why it's so hard, but the workaround below will let you.


If you just wanted to created a shortcut that can run elevated without getting an UAC prompt, then use:
If you wanted to be able to run an elevated program at startup, then use this below to create an elevated shortcut using Task Scheduler, then place the elevated shortcut in your Startups folder.


Whichever one you do, be sure to read all of it and do it step by step, or it will not work. Please ask if you have any questions about it.

OK I'm trying this one: "Elevated Program Shortcut - Create for Standard User - Windows 7 Help Forums"

But when I try to create a shortcut (point 2. on that page) it comes back with the error of "The file runas cannot be found"

Now what?

EDIT:
Clue - when escape from that error, for some reason it has put double quotes around the word "runas".

EDIT2:
I got through it this time. For some reason it was looking for "runas " not "runas". But I still cant get that shortcut to work. Btw, this time I have been trying to run CCleaner in the shortcut. Strangely the shortcut was failing to work even when (as logged in as Administrator) it was on the Administrator's desktop.

I'm seriously thinking this is a waste time. Cant I just lower my UAC settings? Life is too short to do all this for every application I want to run regularly! Also why doesnt it suffice to make my user an Administrator?

EDIT3:
Okay that finally worked. It turned out that my Administrator account had (unaccountably) lost its password. No idea how that happened, btw. I have now done a couple of Shortcuts for different applications. BUT it is still a might pain because for example my image editing program still needs approval to open an image when I double-click on an image file. And it even does so when the program is already open. WTF?

OK whan I am now thinking is that the easiest thing would be not to have ANY user accounts at all, and given that I am the only user of my PC which dont I just log in as Adminsitrator all the time?

I still just can't believe how stupid all this is. (I bet they dont have this sort of stupidity on an iPad! Things just WORK [okay well initially they do!)

OK yes, so I finally got my "Elevated Program Shortcut" to work.

But what happens if I want to open a file without using a shortcut?

Good news.

If you don't open the file from within the program that was opened using the elevated shortcut, then you'll get the UAC prompt.

The reason this is so difficult is because otherwise malware programs would simply use it to bypass UAC and make UAC pointless. Granted, Microsoft could automate something that would use your user credentials, but the point is that this isn't something you should be doing frequently. Most apps should not need UAC, and if there was an easy way to bypass it, app vendors would be lazy and they would simply tell you to add it to a whitelist. Then, all apps would be running as administrator, and it would mean that every app could now corrupt the system.

Microsoft is purposefully trying to force app vendors to write apps that don't require elevated privileges unless absolutely necessary.

Even when you slide UAC down to the bottom, it is still running. It will not completely shut off like it does in Vistpoop or 7.

Mystere said:

The reason this is so difficult is because otherwise malware programs would simply use it to bypass UAC and make UAC pointless. Granted, Microsoft could automate something that would use your user credentials, but the point is that this isn't something you should be doing frequently. Most apps should not need UAC, and if there was an easy way to bypass it, app vendors would be lazy and they would simply tell you to add it to a whitelist. Then, all apps would be running as administrator, and it would mean that every app could now corrupt the system.

Microsoft is purposefully trying to force app vendors to write apps that don't require elevated privileges unless absolutely necessary.

Click to expand...

No I simply dont get this. Why THE HECK cant I have my own whitelist?

i.e. Why cant I log in as administrator and PERMANENTLY approve what ever I want to approve and everything else would need to be approve manually.

Why is it better that giving permission to something ten times per day is any safer than given it permission once?

Whatever happened to "empowering the user" ? It's more like Microsoft despite the user for caring about their own inconvenience, because Big Brother knows better. Idiots.

P.S. In practice, given the choice between
A) approve permission every time you open something + good security OR
B) no approval of anything ever + poor security
...that I and most business users I know would settle for the latter!

But I still dont get why we cant be empowered to have whitelists. Double password protect them if you must but empower us!

ship69 said:

No I simply dont get this. Why THE HECK cant I have my own whitelist?

Click to expand...

I will repeat. Because Application vendors are lazy. If Microsoft provided this functionality, then application vendors would not fix their applications and just tell you to add their app to the white list.

Most apps do not need elevated privileges to accomplish their tasks, and if they do can be written to request privileges only when they need them (ie just before they make a change that requires them). But, app vendors being lazy, they would rather put the onus on YOU than fix their apps.

Microsoft is doing this because it's the right thing to do. I know you are upset that you can't get what you want, but in the grand scheme of things, it's more secure for apps to be written correctly.

ship69 said:

Why is it better that giving permission to something ten times per day is any safer than given it permission once?

Click to expand...

It's not. You should demand that your app vendor fixes their app. Not that the OS vendor break their OS to allow the broken app to not annoy you.

ship69 said:

Whatever happened to "empowering the user" ? It's more like Microsoft despite the user for caring about their own inconvenience, because Big Brother knows better. Idiots.

Click to expand...

No, the app vendor is the one at fault here. Put the blame where it belongs.

As an example, your "Everything" application should have written their search indexer as a Windows Service, then it wouldn't need approval. But since they didn't, their failure is your annoyance. Likewise, their search client shouldn't demand admin privs to run. It should only need them when it needs to do something administrative.

Mystere - I see your point of view. You are coming from the "Big Brother knows best" school.

I come from a different school.

Take iTunes for example who won't let me use any of my normal password conventions. Now I profoundly object to this on several levels:

1. My passwords are all technically bullet-proof.
e.g. take this one:
"tzstp#ssw$rd444abc"
It would take my PC 43 Quintillion years to crack it according to howsecureismypassword.net
However because it has thee "4" characters in a row Big Brother iTunes (Apple) says it's not secure enough(!)

2. I like to have my own special naming conventions so that I can easily remember my passwords site by site.
So why should Apple force me into a special exception that I then need to write down somewhere (insecure!)

3. Personally on some sites including deliberately choose short low security passwords because I dont give a damn if they get hacked. Screw 'em. The result is that I refuse do use iTunes (for this and several other reasons I may say!)

I say that the customer should be empowered!



Yes, the customer should be discouraged from doing something seriously stupid and dangerous, but sometimes the customer WANTS to do something seriously stupid and dangerous. It's a free country, and yes, I am prepared to spill blood to keep it that way. For inspiration checkout this:
[video=youtube;TWfph3iNC-k]http://www.youtube.com/watch?v=TWfph3iNC-k[/video]
Yes Jeb Corliss will probably kill himself doing it but... WTF - what a way to go!

ship69 said:

Mystere - I see your point of view. You are coming from the "Big Brother knows best" school.

Click to expand...

This has nothing to do with Big Brother. Microsoft is doing this as leverage to make app vendors write apps correctly, not to control your behavior. If you don't like it, turn off UAC (but that will have other consequences).

The fact of the matter is, I like what Microsoft is doing. So here's the question. If the customer is always right, which customer is right? I say Microsoft should do what they're doing. You say they should do something different. It can't be both ways, because this is a fundamentally mutually exclusive condition.

"The customer is always right" only works in the service industry, not with products. Because people will always have different opinions of how products should be designed.

Regarding your password issues with iTunes, I'm not happy with their choices either. However, they are doing this because they have had a large number of break-ins due to weak passwords, and subsequent fraud. They have to protect their financial interests.

By the way, those password strength checkers give you a false sense of security. They do not take dictionary attacks into account. Many passwords that on the surface seem secure are not because they have common patterns to them which make them easier to crack. In your example, for instance, it includes several common patterns. (repeating characters and sequential characters.. ie 444 and abc). This reduces the strength of the password significantly (although in your case it's still pretty secure, it's just not as secure as those password strength tools tell you).

ship69 said:

Yes, the customer should be discouraged from doing something seriously stupid and dangerous, but sometimes the customer WANTS to do something seriously stupid and dangerous. It's a free country

Click to expand...

Yes, but you are forgetting that in many cases, people's "stupidity" can cost others. In the case of iTunes, using weak passwords can cost Apple millions of dollars in fraud. In the case of using a weak password on an email account (say yahoo or Hotmail) then if that is compromised spammers can use that to spam millions of people, costing Hotmail and those users real money. Your actions in many cases have direct affect on others.

So yes, by all means, if your actions only affect you.. be as stupid as you want. But if they affect others, then I think its reasonable to expect a certain level requirements on the user.

Mystere said:

This has nothing to do with Big Brother. Microsoft is doing this as leverage to make app vendors write apps correctly, not to control your behavior. If you don't like it, turn off UAC (but that will have other consequences).

The fact of the matter is, I like what Microsoft is doing. So here's the question. If the customer is always right, which customer is right? I say Microsoft should do what they're doing. You say they should do something different. It can't be both ways, because this is a fundamentally mutually exclusive condition.

Click to expand...

Yes, I do accept most of your points... however no, this is NOT a mutually exclusive situation!

To get clear, I am very happy for you (if you so choose) to keep manually saying "yes" to approve the exact same piece of software to run if that's what you want to do. I have no problem with that.

At present Microsoft have already given us the options switching the whole (hateful) UAC system off.

All I ask for is a third option which is that with enough effort, that I be allowed think carefully and to give PERMANENT permission for something to run. Build a while new sub-system of necessary but don't force us to have to keep approving the same thing again and again and again. I totally disagree with you about how having to approve something multiple times is any more secure.

Sorry but to me being forced to approve something multiple times is extremely dangerous because one then gets into the habit of approving popup boxes without properly reading them each time. This is WAY more dangerous!

In the end it's about personal preference and convenience.

And I do NOT want to stop all approvals. I want to approve everything that opens, but I only want to approve it once. In the real world what legal contract are you asked to sign again and again and again multiple times per day. Frankly it's just nuts.

To be fair, perhaps is something looks seriously dangerous I should be forced to approve it again once or twice... but certainly multiple times per day, not FOREVER.

So, no, this is not a mutually exclusive situation, it is about building intelligent options for the informed user into the system.

And I personally believe it is completely intelligent to want to approve things only ONCE.