I have a autoit script that I am using for automation testing. My autoit script is called from a vb.net file. Dialog box of UAC settings will appear and is stopping the execution of test scripts. Currently I am trying process.startinfo.username and password to give specifically username so it may execute the script. Please guide how can I avoid that UAC during my tests execution.
Either change the script so that it doesn't need to be elevated or launch it from something that is already elevated. You'll need to consent once to elevate the "Something" then you should be ok. You can also use scheduled tasks to launch elevated things, and consent once when setting up the tasks, but not again when the task runs.
THe only way to avoid it is to sign your assembly with a strong key. There are instructions here on How to: Sign an Assembly. You must first purchase a code signing certificate though from a 3rd party. You can also make your own certificate but I am not sure if signing your code with a custom made certificate will make the UAC screen go away. I would try making your own certificate first and signing your assembly and seeing if that fixes the problem. If not, you can purchase a code signing certificate from several places, such as GoDaddy, VeriSign or from Thawte, just to name a few
Related
Greetings good people of stackoverflow.
I have made an msi-installer with WIX and some custom actions built in C#. The main reason for this installer is that the original software package we want to silently install, doesn’t support this in a good way. To circumvent this issue, I extracted the files needed and put them in my own installer.
The software itself is an HMI/SCADA system containing two main types: Server and client runtimes. My focus is on the client side. This is needed to run projects made in the SCADA “IDE”.
So, my package installs the client-side SCADA, the project and my custom action creates an ODBC-connection.
The client runtime installs in the exact folders as it would have been with the original MSI i.e in C:\ProgamFiles. The SCADA client project installs in C:\ProgramData. The custom action creates an ODBC using C# and Registry.LocalMachine. The custom action also makes some changes to some textfiles in the SCADA client project in ProgramData.
The installation works well when it’s running from command prompt with “msiexec /quiet /i “Installerproject.msi”.
With all this in mind, there is one customer with an IT department that uses this package to roll out on its user’s machines. They get stuck in SmartScreen and must manually push “Run anyway”. The message is:
Microsoft Defender SmartScreen prevented an unrecognised app from
starting, Running this app might put your PC at risk.
App: “My installer name”
Publisher: Unknown.
I’ve tried use this installer on virtual machines and only with command prompt, and it doesn’t show this message.
I’m not sure what to do. Is the only way to use EV certs? Even if the original software is issued as a trusted publisher? What’s your take on this? I really need some guidance.
Best regards
Thanks Scaler for the nudge to the right direction. I have signed the installer with a CodeSigning certificate.
This is my first time trying to deploy a VSTO add-in to a user's system, and I am running into a security barrier. The add-in was built in Visual Studio 2019 Community Edition and is meant to integrate with Microsoft Excel. The user runs Office 365.
On running Setup.exe, user receives the initial confirmation prompt and clicks "Install." A progress bar briefly appears and runs about 25% of the way, then an error message pops up: "Customized functionality in this application will not work because the certificate used to sign the deployment manifest for [the add-in] or its location is not trusted."
I understand that Microsoft would like me to pay for a signing certificate, but I am hoping to get this to work while avoiding that expense.
This article from Microsoft describes the use of a digital certificate as "an optional step": ClickOnce and Authenticode. This article states that an alternative route is for the user to click the "ClickOnce trust prompt" during installation: Grant trust to Office solutions. But as far as I understand the process, it is halted before it even gets to the ClickOnce trust prompt, so the user never gets that option.
For comparison, the user ran the installation on an older system. On that system he received the ClickOnce prompt, approved the software, and the installation ran successfully to the end. This indicates very strongly that the problem on the newer system is a security setting.
I instructed the user to open Excel and go to Options > Trust Center > Trust Center Settings > Add-Ins and remove the check mark from "Require Application Add-Ins to be signed by Trusted Publisher." There was no check mark to begin with, so that setting was not the issue.
I have instructed the user to go to the command prompt and clean out any remnants of the failed install with rundll32 dfshim CleanOnlineAppCache before each new installation attempt.
I'm at a loss as to where to look next. Any help would be much appreciated.
One relatively easy workaround: you pack the "publish" folder as ZIP file, disable any online checks or deployments (in the project settings, select to publish locally, not to a website. Installing from a website or auto-update won't work without normal certificate). Then give your user that ZIP. User downloads that ZIP, then right-click the ZIP file and checks "Unblock". Then unzips and installs normally. Now any certificate should do. This applies if your user downloads your file from the internet.
So the idea is very simple: Just tell your user to click "Unblock" checkbox before extracting files from the ZIP archive you have sent and running them.
Another solution, you simply tell the user's system to trust your "self-signed" developer's certificate (add your certificate to "Trusted Publishers" store on the user computer). For that you need admin rights. Please note that user's admins probably won't like this idea, unless you and your user work in the same organization. Here are the instructions: https://learn.microsoft.com/en-us/skype-sdk/sdn/articles/installing-the-trusted-root-certificate
The best and easiest of course would be if you buy a normal code signing certificate. They are not that expensive, you can get one from COMODO (SectiGo) for example for something like $70/year though their resellers.
On the target machine. you need to install and trust the certificate used to sign your addin (see Signing tab of your project options)
What is required for the certification process, is it a quick process? Are they certifying me/ my business or the code??
It is a quick process for the process:
Sign with valid certificate when publishing.
Add the publisher into Trusted Publisher before installing when Macro Settings is a high security level.
Finish installing.
You can obtain a certificate for code signing in one of three ways:
Purchase one from a certificate vendor.
Receive one from a group in your organization responsible for creating digital certificates.
Generate your own certificate with MakeCert.exe, which is included with the Windows Software Development Kit (SDK).
I've noticed something somewhat strange when I ran the Xcode build of my app and then launch the app store build. If I run the xcode build (using development certificates), then run my app through the app store (using production certificates) I get prompted with the following dialog box
MyApp want to use your confidential information stored in "com.myApp in the keychain.
I also get this dialog when I run the app store build first, then the Xcode development build. I believe this dialog appears because both builds have different certificates (could be wrong).
My biggest concern is the user updates the app, will the user see this dialog?
Not sure if this is important, but this is how I save data to the keychain.
[[A0SimpleKeychain keychain] setString:string forKey:#"key"];
Apple's code signing guide has the answers.
I believe this dialog appears because both builds have different certificates
Correct. See Understanding the Code Signature:
The most important internal requirement is the designated requirement, or DR. This rule tells an evaluating system how to identify a particular piece of code. Any two pieces of code that have (and successfully verify against) the same DR are considered to be the same code.
...
Some parts of macOS do not care about the identity of the signer. They care only whether the app is validly signed and stable. Stability is determined through the DR, and does not depend on the nature of the certificate authority used. The keychain system and parental controls are examples of such usage.
From Code Signing Tasks:
Shipping and Updating Your Product
The user’s system considers the new version of your product to be the
same program as the previous version. For example, Keychain Services
does not distinguish older and newer versions of your program as long
as both are signed and the unique Identifier remains constant.
Signing your code with a different certificate makes the system consider it a different app. As long as you sign your releases with the same certificate between versions, you will be fine.
I was recently given a VB.NET project for fixing some bugs and creating an installer for it. I was told to use Install Shield LE.
All went well with creating the install script but Windows 8 is giving me a smart screen warning when downloading the application from a web site and trying to install it.
I am aware of Windows 8 policy where popular applications get more "trust points" and become popular but the application is targeted for a fairly small audience of people therefore we can not rely on this option. Even more, people without proper knowledge would be repelled by the warning message and that could cause MS to never raise the trust for the application.
My question is, do I have to sign both - the application and the installer with a certificate? If so how do I sign the installer, as there is a signing tab for the project but I can't find one for the installer.
Bonus points if anyone can tell me if acquiring a proper certificate will remove the warning message telling this isn't a commonly downloaded file and might be dangerous from chrome/IE when downloading the application. There are many threads about this, I know, but most of them suggest adding the site to webmaster tools but that hasn't helped and we're still receiving the message
Thanks.
If I have read your post correctly then you are talking about an application as opposed to a website, and for that you would need a code signing certificate. Certificates that sign websites are different so first and foremost decide what it is that you are producing and want to sign.
Having decided that then you need to decide who you will use to supply your certificate. Typical sources would be VeriSign, Thwaite or Globalsign to name but three. All charge different prices but essentially do the same thing.
Once you have the certificate then the installer that you use to build your application signs the code files you select and the actual installer (msi or exe) itself.
That should eliminate the message that you now see warning people about potentially dangerous files that they are about to download.
I cannot stress enough however that you need to be clear about which type of certificate you need BEFORE you go ahead and buy one. I think from your description you are talking about a code signing certificate but do check first.
Following CAB forum regulation you will need to have an Extended Validation code signing in order to bypass the smart screen filter.
Extended Validation code signing will establish immediate trust with the machine, as you go through a more stringent validation process to obtain it! (or at least that's the rationale behind it!)
I think you can get an extended validation code signing either from SYmantec or GLobalsign.
When I install my application on my computer I get a warning that the publisher is not verified. How can I change that? or do I need to worry about that when I distribute my application?
The application is written in Visual Studio 2008 with VB.NET
On the Project Properties window, go to the Signing tab. Create/Import certificates and sign the manifests and/or assembly.
You can find more information here, with helpful links at the "See Also" section.
You can use the signtool command line program to sign exe files or msi files. I believe you might need a certificate from an official authority to change the UAC messages.