UAC: Manifest file is ignored - windows-server-2008

One of my Executables writes some configuration into a XML file to C:\Program Files\MyApp\config.xml. It needs to run as Administrator on Vista / Server 2008, otherwise the OS won't let it write to that location.
I included a manifest file named config.exe.manifest, to automatically request administration rights at launch.
Here's my manifest file:
<?xml version="1.0" encoding="utf-8"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator" />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
I tried this on Windows Server 2008, but the manifest file seems to be ignored and the executable is launched without sufficient rights.

http://blogs.msdn.com/junfeng/archive/2009/05/11/internal-manifest-vs-external-manifest.aspx
quoted from above link:
In Windows XP, Sxs searches external manifest before internal manifest. If an external manifest is found, the internal manifest is ignored.
In Windows Server 2003 and later, the order is reversed. Internal manifest is preferred over external manifest.
If you use external manifest, and your scenario works in Windows XP, but not Windows Server 2003 and later, please double check the executable does not have an internal manifest

This will drive you batty - got to the bottom of it and posted an article and some utilities to help with your manifest being ignored: Find Out Why Your External Manifest Is Being Ignored.

Ok it works when I embed the manifest file using MT.EXE. Still don't why it doesn't work when I provide the manifest as a separate file, but I guess embeding is a good enough solution.

Related

How Can We Determine Which App.Config File Is Loading in VSTO Outlook Add-In?

We have a very strange problem with our VSTO Add-In.
In our Add-In there are label controls that read label text values from an app.config file and display text from the configuration file to the user:
<!-- app.config -->
<configuration>
<configSections>
...
</configSections>
<!-- start applicationSettings -->
<applicationSettings>
<OurVSTOAddIn.MySettings>
<setting name="ackMsg" serializeAs="String">
<value>Some text here that we want to display and change</value>
</setting>
...
<OurVSTOAddIn.MySettings>
</applicationSettings>
</configuration>
'vb.net code
objCheckDialog.lblAttachmentsMsg.Text = My.Settings("attachmentsAckMsg").ToString()
objCheckDialog.lblAttachmentsMsg.Visible = True
We recently updated the app.config file to replace English display information with Kanjii for our end-users in Japan.
When we rebuilt the MSI and installed on our test machine, the add-in isn't displaying Kanjii (although it display correctly in development).
Now we're wondering if the configuration file in the installation directory is being read at all or if the information is cached or the add-in is reading from another file somewhere.
What's even more strange is that we've changed other values in our app.config file that are being used in code logic, and these seem to load properly.
We're currently using Procmon in an effort to find out how the config file is loaded, however, while filtering on the following:
Process Name contains Outlook
Path Contains "OurOutlookPlugInName"
This produces over 400 results but we don't see any file handling for our config file unless I debug the code in Visual Studio.
On our installation machine, we also removed the configuration file from the installation directory thinking this might be a clue as to whether the Add-In is reading the configuration file from the installation directory, but it had no effect, and the Add-In loaded normally displaying English instead of Kanjii again.
All of the configuration settins are at the Application Level.
Is there a way for us to tell where our Add-In is loading our configuration file from?
Have we done something incorrect in our MSI build that would prevent the updated configuration file from loading?
UPDATE:
I opened the dll file in the C:\Program Files (x86)\OurVSTOAddIn installation directory using Telerik JustDecompile to see if the configuration settings were written somewhere in the dll and I can see that under OurVSTOAddIn->My Settings there are definitely DefaultSettingValues there, as shown below:
This would make sense since these are Application Scoped Settings and this would prevent a user from changing config settings.
But I'm thinking if we use Application Scoped variables, each time we'll need to rebuild the msi for release, which doesn't make sense to me since the reason we want to use configuration settings for the project is to not need to rebuild for configuration changes.

How to stop files been saved in Virtual Store / ProgramData?

[ I submitted this question 2 months ago and didn't have any replies ... and obviously the problem is still live and we are about to release a new version of our app, so now am writing some documentation to get the users to delete any entries in the virtual store - something I didn't want to do .... so now really hoping someone out there can help us ?! ]
I appreciate that there is a lot of info regarding this topic, but I am still having an annoying issue and not sure where to go with it ... hence coming here !!
We have an app (VB.NET) that now installs REPORT files into a folder under ProgramData. Now our app dll is run from a third party app ( that we obviously have no control over ) and this third party app allows people to run the reports; but when a report is run, it then updates the report, so that it's "last run date" is stored. This is what is causing us the fun we are having.
With UAC on, the report files are been copied to the equivalent location within the Virtual Store. This of course is ok while they are using the current version of our app, but when we release a new version ( with modified reports ) these new versions are getting installed correctly into ProgramData, but when the user runs the app - they are seeing the outdated reports from Virtual Store.
We are very close to writing some installation documentation, telling folk to delete any reports from Virtual Store, before installing our new version - but this is a real cop out !!
The third party app also installs its own reports ( into a different location under ProgramData ) and they are able to update their reports without Virtual Store kicking in - so we know it's possible !
I have just added a manifest to our dll :
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
hoping that would be the cure, but alas no !
So, I'm open to any suggestions that you folk may have ?!?
Cheers,
Chris.
VirtualStore is used when the user doesn't have permissions to write into the requested program folder. So the simpliest solution is to give your users permission. Actually, I like to use a user group so there is some security left.
System Tools > Local Users and Groups > Groups, "New group" and create say "XYZCompanyUsers".
Windows Explorer > Program Files (x86) > XYZCompany, "Properties" "Security". Now add the new group "XYZCompanyUsers" and give them full permissions.
The application needs to have the assembly manifest.
Putting asInvoker in the assembly manifest of a .dll will not help you.
Now our app dll is run from a third party app ( that we obviously have no control over )
You need to tell the 3rd party app to write a correct Windows application. And correctly written Windows applications have an assembly manifest. If their .exe does not have a manifest, then it is not a correctly written Windows application. (A manifest is part of the Windows programming ground rules).
if they don't have a manifest: you can create your own and place it in their executable (e.g. using ResourceHacker, or MT which can be found in the Windows 10 SDK)
or you can edit their existing assembly manifest (again using Resource Hacker) to include the asInvoker attribute
or you can place an external (CotosoApp.exe.manifest) manifest

7zip Self Extracting Archive (SFX) without administrator privileges

I use 7zip to create the SFX as follows:
7z.exe a -r archive.7z *
Then I do a binary copy with the 7zS.sfx file (used to create a self extracting installer), config file "build.config", and the archive. The contents of config file are as follows:
;!#Install#!UTF-8!
RunProgram="setup.exe"
GUIMode="1"
Path="%tmp%\\mytemp"
;!#InstallEnd#!
Binary copy command is as follows:
copy /b 7zS.sfx + build.config + archive.7z sfxInstaller.exe
Problem is that the result SFX "sfxInstaller.exe" requires admin privileges for executing. Is it possible to generate Self Extracting Archives using 7-Zip that do not require admin privileges? If so, what parameters/command line arguments should I use?
Thanks in advance.
I fixed this problem with mpursuit answer.
To update manifest of 7zS.sfx you can use the following procedure:
manifest.xml
<?xml version="1.0" encoding="utf-8"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!--application support for Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--application support for Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
</application>
</compatibility>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
call "C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\vcvarsall.bat" x86
mt.exe -manifest manifest.xml -outputresource:"7zS.sfx;#1"
copy /b 7zS.sfx + build.config + archive.7z sfx_archive.exe
You can embed a manifest file in the original 7zs.sfx that informs Windows to run the extractor with the same access token as the parent process. Which will cause the self extractor to run as a normal user if that is what the user is login as.
The following link describes how to embed a manifest file in an executable using Visual Studio 2005, but the same process applies in later versions. https://support.microsoft.com/kb/944276
Once you have embedded the manifest file that sets the "requestedExecutionLevel" to "asInvoker", any self extracting archieve created in the normal way with the modified 7sz.sfx will not require administrator privileges.
Unfortunately I have not found a way to generate SFXs using 7zip that do not require admin privileges. Having tried some other SFX generators, I stopped at IExpress that has completely satisfied my needs.
Put MiscFlags="4" in your config file. That should fix your problem.
It should look like this:
;!#Install#!UTF-8!
RunProgram="setup.exe"
GUIMode="1"
Path="%tmp%\\mytemp"
MiscFlags="4"
;!#InstallEnd#!
I don't understand how MiscFlags="4" can solve the problem.
What is the reason of the problem? You use copy /b 7zS.sfx (or 7zS2, or 7zSD, doesn't matter) with your files and it will get you a file with permissions to run only as administrator. The information what role (admin, simple user) can run the application is stored in manifest inside the application. 7zS (or 7zS2, or 7zSD) doesn't have manifest. So if you use Windows Vista or further, the result file will prompt you to enter admin credentials.
This article will help you. Read from "Getting Rid of UAC Prompt".
https://www.excelsiorjet.com/kb/35/howto-create-a-single-exe-from-your-java-application
You can fix the problem using resource editor software such as ResEdit. You should add a manifest to the 7zS.sfx file with the security information:
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
You can use 7zsd.sfx instead of 7zs.sfx.
This will not require admin privileges.
it worked fine thanks for the help
but I used
call "C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\vcvarsall.bat" x86
mt.exe -manifest manifest.xml -outputresource:"7zSD.sfx;#1"
copy /b 7zSD.sfx + config.txt + techselfsupport.7z techselfsupport.exe

MSBuild or StyleCop task to verify key in App.config file?

In several projects’ App.config file, there is a line
<add key="url" value="http://www.example.com/"/>
Upon each build, I want to have a task to verify that the "url" key does not have the text "http://localhost". Is there a way to do this?
I'm assuming you have a team, and some of your team members inadvertently checkin those configs, changing that value to localhost.
If this is the case, why not have transform files for each environment, where your debug configuration can set the key to localhost, and your production/test/stage/qa/whatever configuration can set it to example.com or something else.
You might not have been aware that msbuild can transform your config files. Essentially you have your main config file, and then a config file containing just the things changed, for each environment. Upon doing a build, msbuild will modify the main one with whatever the changes are in the other "transform" files.
App.Config Transformation for projects which are not Web Projects in Visual Studio 2010?
Your transform file would look like:
<?xml version="1.0"?>
<!-- For more information on using web.config transformation visit http://go.microsoft.com/fwlink/?LinkId=125889 -->
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
<appSettings>
<add key="url" value="http://www.example.com/" xdt:Locator="Match(key)" xdt:Transform="SetAttributes"/>
</appSettings>
</configuration>
The microsoft link is to http://msdn.microsoft.com/en-us/library/dd465326(VS.100).aspx
They can easily be used on web.configs, as well as app.configs, with a little tweaking to your project file.
An alternative solution would be to integrate unit tests as part of your build, and have the test verify the key in your web.config.
Go to your builds:
Right click on your build and click on edit build definition:
Choose process:
Now we can set fail on build here:

How to Install NeatUpload?

Salvete! Whilst searching for a quality, free asp.net/ajax upload control, I found NeatUpload. I cannot find an online demo for it, but the download package does come with a demo. I need some help installing it on my server (Windows Server 2008).
I followed the directions at http://mumblestiltskin.blogspot.com/2009/10/using-neatupload-simple-setup.html (they are basically the same as the directions in the manual.htm that comes with the NeatUpload binary package).
So far, I have
Successfully installed Brettle.Web.NeatUpload.dll to the GAC using
gacutil.
Added the reference in my web.config (with version and guid)
copied the demo file and its code-behind to my web application (which
is registered in iis7)
Now, when I browse to the page, I get an asp.net server error on
Line 35: protected MultiFile multiFile;
Line 36: protected MultiFile multiFile2;
Line 37: protected InputFile inputFile;
and
error CS0246: The type or namespace name 'MultiFile' could not be found (are you missing a using directive or an assembly reference?)
error CS0246: The type or namespace name 'MultiFile' could not be found (are you missing a using directive or an assembly reference?)
error CS0246: The type or namespace name 'InputFile' could not be found (are you missing a using directive or an assembly reference?)
error CS0246: The type or namespace name 'InputFile' could not be found (are you missing a using directive or an assembly reference?)
error CS0246: The type or namespace name 'ProgressBar' could not be found (are you missing a using directive or an assembly reference?)
error CS0246: The type or namespace name 'ProgressBar' could not be found (are you missing a using directive or an assembly reference?)
What do I do now? Do I need to copy another dll somewhere, or certain files? I can't figure it out from the documentation.
Figured it out! I am deploying the control to a sharepoint web application. (Below, consider SPVD as "Sharepoint Application's Virtual Directory".) If you are not deploying to a Sharepoint website, then you will use the root of your web application's virtual directory where I have used Sharepoint's instead. Here are the steps I followed to get the demo page to run on my server.
Firstly, configuration is different if you use a "web-application" instead of a "web-site". I won't go into the difference here. But in my example, I am configuring a simple "web-site".
I had to:
Copy Brettle.Web.NeatUpload.dll into the GAC on the server (it seems that on Windows Server 2008, you don't have to use the gacutil - just copy the dll into %windir%\assembly. Also note that you must do this on the server; it doesn't work right if you try to do it over a network share). If you don't do this, the NeatUpload Demo just won't do anything. You will have to restart the website in IIS after you do this.
Some of the guides say you need to update the web.config to display the appropriate version and guid, but I found that I didn't have to do that (you will see my web.config below) - UNLESS - you want to use neatupload's section configuration in web.config. So, it is better just to do it right, you know.
The guides also say to use the guid and version number in the aspx pages, like demo.aspx, So, replace this:
<%# Register TagPrefix="Upload" Namespace="Brettle.Web.NeatUpload" Assembly="Brettle.Web.NeatUpload" %>
with this:
<%# Register TagPrefix="Upload" Namespace="Brettle.Web.NeatUpload" Assembly="Brettle.Web.NeatUpload, Version=1.3.3798.663,Culture=neutral, PublicKeyToken=c95290d92c5893c8" %>
Copy the entire directory at NeatUpload-1.3.25\dotnet\app\bin to SVPD\bin. It contains the following items:
Brettle.Web.NeatUpload.dll (the same as the one you installed to the GAC)
Brettle.Web.NeatUpload.GreyBoxProgressBar.dll
Brettle.Web.NeatUpload.HashedInputFile.dll
Hitone.Web.SqlServerUploader.dll
a directory called en-US (with a dll in it)
another direcotry called fr (with a dll in it)
several .mdb databases, and Brettle.Web.NeatUpload.xml
Add the references to the http modules to the web-application's web.config file (see web.config sample below).
Now, you need to copy the directory: NeatUpload-1.3.25\dotnet\app\NeatUpload to SPVD, and leave it named NeatUpload, so that you have SVPD\NeatUpload with all its original contents. Now, in that folder, there are two files you need to edit: Progress.aspx and SmoothProgress.aspx. In the guides, I was told to use the guids and version numbers in the # declarations, such as this:
<%# Page language="c#" AutoEventWireup="false" Inherits="Brettle.Web.NeatUpload.ProgressPage,Brettle.Web.NeatUpload,Version=1.3.3519.18793,Culture=neutral,PublicKeyToken=C95290D92C5893C8" %>
<%# Register TagPrefix="Upload" Namespace="Brettle.Web.NeatUpload" Assembly="Brettle.Web.NeatUpload, Version=1.3.3798.663,Culture=neutral, PublicKeyToken=c95290d92c5893c8" %>
Here is the web.config I put in the folder with the demo page.
<?xml version="1.0"?>
<configuration>
<configSections>
<!--You need this part so that you can have a neatupload configuration section. You will get .net errors if you try to add the configuration section without this part here.-->
<section name="neatUpload"
type="Brettle.Web.NeatUpload.ConfigSectionHandler, Brettle.Web.NeatUpload"
allowLocation="true"
/>
</configSections>
<!--This is where you put your neatupload configuration preferences.-->
<neatUpload xmlns="http://www.brettle.com/neatupload/config/2008"
useHttpModule="true"
/>
<system.web>
<customErrors mode="Off"/>
<!-- Always required to use any of NeatUpload's features. Without it, ProgressBars won't display and MultiFile will look like a regular HtmlInputFile. -->
<httpModules>
<add name="UploadHttpModule" type="Brettle.Web.NeatUpload.UploadHttpModule,Brettle.Web.NeatUpload,Version=1.3.3798.663,Culture=neutral,PublicKeyToken=c95290d92c5893c8" />
</httpModules>
<!-- Set these next 2 attributes large enough to accomodate the largest and longest running upload you want to support. Note that browsers and IIS typically don't support uploads larger than 2GB (2097151 KB). -->
<httpRuntime maxRequestLength="2097151" executionTimeout="999999"/>
<!-- Not required for NeatUpload but makes it easier to debug in VS. -->
<compilation debug="true"/>
</system.web>
<!-- For IIS7's Integrated Pipeline Mode which is used by the DefaultAppPool. -->
<system.webServer>
<security>
<requestFiltering>
<!-- Increased maxAllowedContentLength from default of 300MB. -->
<requestLimits maxAllowedContentLength="2147483648" />
</requestFiltering>
</security>
<modules>
<add name="UploadHttpModule" type="Brettle.Web.NeatUpload.UploadHttpModule,Brettle.Web.NeatUpload,Version=1.3.3798.663,Culture=neutral,PublicKeyToken=c95290d92c5893c8" preCondition="managedHandler"/>
</modules>
<validation validateIntegratedModeConfiguration="false"/>
</system.webServer>
</configuration>
Some Notes on Installation Packages
The installation package I used was at http://neatupload.codeplex.com/releases/view/46086 - there seem to be a few others, such as a "binaries package" at http://neatupload.codeplex.com/releases/view/59339, but the directory structure is different, and the instructions won't make much sense. There is also a package on the main project page at CodePlex: http://neatupload.codeplex.com/, but if you use this package, you will have a different version number and guid for the dll when you deploy it to the GAC.
Instruction Manuals
By way of an instruction manual, check out: http://mumblestiltskin.blogspot.com/2009/10/using-neatupload-simple-setup.html?showComment=1335835416022#c1846924755786832325, and there is also an html manual in the binaries package above. In the other packages, you have to "build" the manual with Open Office. Then, of course, you can reference this post!
Troubleshooting
Having problems?
How to Overcome this NeatUpload Object Reference Error?
NeatUpload Nabble Forum: http://neatupload-help.688956.n3.nabble.com/
The only thing left now, is to add some sort of handler for copying the files to where you want them. NeatUpload only adds them to a temp file, and I have yet to figure out where it is...