How do you determine when #RequireAdmin is needed?

[ahha]

I have a general question. Is it possible to tell under program control when #RequireAdmin is needed?

Specifically I can WinMove the Date and Time window without #RequireAdmin, however I cannot WinMove the System Properties window without using the #RequireAdmin.

This script shows the issue.

expandcollapse popup

;#RequireAdmin ;<-- makes A BIG difference
#AutoIt3Wrapper_run_debug_mode=Y ; use this to debug in console window <--- LOOK
Opt("WinTitleMatchMode", -2) ;nocase partial match okay

;MoveIt($pgm, $pgm_title)

MoveIt("notepad.exe", "notepad") ;works
MoveIt("cmd.exe", "cmd") ;works
MoveIt("control timedate.cpl", "Date and Time") ;works
MoveIt("systempropertiesprotection.exe", "System Properties") ;FAILS - handles correct, Winclose fails, etc. - actually hangs next run command - manually close window after MsgBox winclose pops up - then it will continue correctly
MoveIt("control timedate.cpl", "Date and Time") ;works
MoveIt("control sysdm.cpl", "System Properties") ;try old version - FAILS ALSO

;??? Is there some special approach needed to move a System Properties box ??? YES YES YES IT REQUIRES #RequireAdmin !!!!!

Exit


Func MoveIt($pgm, $pgm_title)
Send("#r") ;open run box
;wait for it
WinWait("Run") ;partial match
If Not WinActive("Run") Then WinActivate("Run")
WinWaitActive("Run")

Send($pgm & @CRLF) ;run program
WinWait($pgm_title) ;partial match
If Not WinActive($pgm_title) Then WinActivate($pgm_title)
WinWaitActive($pgm_title)

MsgBox(0,"Debug","Ready to move.")
$hl = WinMove($pgm_title, "", 0, 0)
MsgBox(0,"Debug","Should be at 0,0 and handle = " & $hl & " (0=not found)")
$hl = WinMove($pgm_title, "", 100, 100, Default, Default, 100) ;move slowly keep current size
MsgBox(0,"Debug","Should be at 100,100 and handle = " & $hl & " (0=not found)")

MsgBox(0,"Debug","Move completed.")
$r = WinClose($pgm_title) ;be polite and close it
MsgBox(0, "Debug", "WinClose return value = " & $r)
EndFunc

[guinness]

IsAdmin maybe?

[JohnOne]

If you can determine the process from which the window belongs, you might get the desired results by testing if that executable process requires administrator rights.

for vista and above you could use _IsElevationRequired()

[ahha]

guinness - IsAdmin only shows if the current user is admin or not. I'm trying to determine if a program requires admin to run or not. I'll try JohnOne's suggestion and let everyone know.

[ahha]

JohnOne results are as follows for your program (win 8 pro x64)

Running as admin - Notepad = 0, Regedit = 0 ;so it does not seem to distinguish when run in admin

Running NOT as admin - Notepad = 0, Regedit = 1 ;so it DOES distinguish when not run in admin

Thanks for the code. I'll try and incorporate it (giving credit).

I'm still a little puzzled by admin/no admin because although in my program it requires admin to use Winmove to move the System Properties window, I DON'T need admin privileges if I simply use my mouse to move it (i.e user NOT in admin). That is, I can move the System Properties window without the OS popping up the UAC window. This is why I was initially confused because the admin requirement does not seem to be imposed on a person (not in admin mode) using the mouse, but rather only on AutoIt the programming language. Thus I was surprised by this inconsistency in "security".

Edited February 11, 2013 by ahha

[JohnOne]

Ah yes, The function only tells if an executable requires elevation to be ran, so if you are admin, you require no elevation.

Your other query is security, and seems valid to me, it's so a lower privileged app cannot interfere with it I imagine, probably wont be able to close the window either.

[Jon]

Does it write to the registry outside of HKEY_CURRENT_USER? Needs admin

Does it write to the file system outside of %Userprofile%? Needs admin

Does it run any system application this has a shield icon on it? Needs admin

On windows 7 and 8 they made it so that certain system applications with the shield are silently elevated to avoid annoying the user - but only when run manually by the user. But if run with a script you need to handle it if you are using "Run". I think running the program with ShellExecute will bring up the UAC prompt if the exe is manifested correctly.

[ahha]

JohnOne - you're exactly correct - "is elevation required". Once I learn to read it will help You are correct the window cannot be closed under program control (without elevating to admin).

Jon - very interesting.

The challenge I have is that JohnOne's _IsElevationRequired() is limited to checking ".exe" files and I have no idea how to check Jon's listed criteria to know if a window is going to do one of the operations that needs admin. Additionally, I'm not sure how a ".cpl" control can be checked in advance (like timedate.cpl and sysadm.cpl).

So, the challenge is knowing when a program will not be able to manipulate a window that may have been started without admin, like System Properties that as Jon notes can be run manually by a user but not under program control.

Here's my attempt at it - crude as it is with examples to test (key is can you move the window).

expandcollapse popup

;#RequireAdmin ;can toggle so see that "System Properties" correctly runs at Admin level
#AutoIt3Wrapper_run_debug_mode=Y ; use this to debug in console window <--- LOOK

Opt("WinTitleMatchMode", 2) ;1=start, 2=subStr, 3=exact, 4=advanced, -1 to -4=Nocase

;v1a - if you can't move the window you need to run as Admin to control it

;Example 1 - check notepad.exe
$pgm = "notepad.exe"
$pgm_title = "Notepad"
Send("#r") ;open run box
;wait for it
WinWait("Run") ;partial match
If Not WinActive("Run") Then WinActivate("Run")
WinWaitActive("Run")
Send($pgm & @CRLF) ;run program
WinWait($pgm_title) ;partial match

$r = _check_window_move($pgm_title)
MsgBox(0, "Debug -1=not found, 0=OK, 1=need admin", $pgm_title & " - result = " & $r)

;Example 2 - check non-existent file (for correct reporting)
$pgm_title = "This window does not exist"
$r = _check_window_move($pgm_title)
MsgBox(0, "Debug -1=not found, 0=OK, 1=need admin", $pgm_title & " - result = " & $r)

;Example 3 - check Run box
$pgm_title = "Run"
Send("#r") ;open run box
;wait for it
WinWait("Run") ;partial match
If Not WinActive("Run") Then WinActivate("Run")
WinWaitActive("Run")

$r = _check_window_move($pgm_title)
MsgBox(0, "Debug -1=not found, 0=OK, 1=need admin", $pgm_title & " - result = " & $r)

;Example 4 - check .cpl date/time
$pgm = "control timedate.cpl"
$pgm_title = "Date and Time"
Send("#r") ;open run box
;wait for it
WinWait("Run") ;partial match
If Not WinActive("Run") Then WinActivate("Run")
WinWaitActive("Run")
Send($pgm & @CRLF) ;run program
WinWait($pgm_title) ;partial match

$r = _check_window_move($pgm_title)
MsgBox(0, "Debug -1=not found, 0=OK, 1=need admin", $pgm_title & " - result = " & $r)

;Example 5 - check .cpl System Properties - old version
$pgm = "control sysdm.cpl"
$pgm_title = "System Properties"
Send("#r") ;open run box
;wait for it
WinWait("Run") ;partial match
If Not WinActive("Run") Then WinActivate("Run")
WinWaitActive("Run")
Send($pgm & @CRLF) ;run program
WinWait($pgm_title) ;partial match

$r = _check_window_move($pgm_title)
MsgBox(0, "Debug -1=not found, 0=OK, 1=need admin", $pgm_title & " - result = " & $r)

Exit




Func _check_window_move($title) ;returns -1 if window not found, 0 if can move it, 1 can't move it - probably need to run as admin
Local $pos1, $pos2
$pos1 = WinGetPos($title) ;get current coordinates, [0] = X position, [1] = Y position, [2] = Width, [3] = Height
If ($pos1 = 0 AND @error = 1) Then Return -1 ;indicate window not found
WinMove($title, "", $pos1[0], $pos1[1]+1) ;move window quickly only one pixel. Do it vertically as human lower res in vertical.
;WinMove($title, "", $pos1[0], $pos1[1]+100, Default, Default, 100) ;DEBUG - slow to see
$pos2 = WinGetPos($title) ;get current coordinates, [0] = X position, [1] = Y position, [2] = Width, [3] = Height
WinMove($title, "", $pos1[0], $pos1[1]) ;quickly move it back
;WinMove($title, "", $pos1[0], $pos1[1], Default, Default, 100) ;DEBUG - slow to see
;now let's check to see if we were able to move it
If $pos1[1] = $pos2[1] Then
Return 1 ;can't move it
Else
Return 0 ;can move it
EndIf
EndFunc

[JohnOne]

To get the pid of the window handle, I would start with _WinAPI_GetWindowThreadProcessId, from there you can get the name and path of the process.

EDIT: perhaps used in serial with _WinAPI_GetModuleFileNameEx. (WinApiEx.au3)

Edited February 11, 2013 by JohnOne

[BrewManNH]

Just as an FYI in case it wasn't considered. #RequireAdmin isn't something that can be used conditionally, in other words, regardless of where you have it in your script it will always be processed at the start of the script. So, either the whole script has to ran under admin credentials or the whole script has to be ran under the user's credentials. You can't use an If statement, as an example, to determine whether to elevate the script with #RequireAdmin.

[Jon]

All #requireadmin does is to rerun the script with ShellExecute and the runas verb. It just does it in a clever way. But I still don't understand this thread. The script writer knows what processes they are using so why try and determine it programmatically? If you look at certain windows operations they do exactly the same. For example run Disk Cleanup. It runs as a user until you click System Files. At that point it reruns itself with admin rights.

[ahha]

JohnOne - I'll give those a try to find what .exe file corresponds to a cpl.

BrewManNH - understood. It's like a compiler directive of sorts and from Jon's explanation the script reruns itself with ShellExecute and the runas verb.

Jon - "The script writer knows what processes they are using so why try and determine it programmatically?" Not exactly always the case. Let me give you an actual example. I'm not at admin level. I turn on Au3Recorder because I want to generate a script to automate generating a restore point. I move to lower left and right click to bring up commands (because Send("#x") does not work - but that's another issue). Left click on run and type in (or send) "systempropertiesprotection.exe" then click OK. Up pops System Properties and I proceed to click Create, etc. I then stop the script and try running it. It doesn't work for all the reasons above. I need to either run everything at admin level (ugh) or somehow determine programmatically when I need to elevate. That's it.

In this example the user could type in any program name or control to run so we really don't know in advance.

Edited February 12, 2013 by ahha

[ahha]

JohnOne - okay this shows my ignorance . I have the window handle, I have the PID, I even have the TreadID, however _WinAPI_GetModuleFileNameEx ( $hProcess [, $hModule] ) wants the "$hProcess - Handle to the process that contains the module." I've set $hModule to 0 so it should return the executable file of the process. How do I get the handle to the process?

;
;#RequireAdmin ;can toggle so see that "System Properties" correctly runs at Admin level
#AutoIt3Wrapper_run_debug_mode=Y ; use this to debug in console window <--- LOOK

#include <WinAPI.au3>
#include <WinAPIEx.au3>

Opt("WinTitleMatchMode", 2)  ;1=start, 2=subStr, 3=exact, 4=advanced, -1 to -4=Nocase

;Example 1 - check notepad.exe
$pgm = "notepad.exe"
$pgm_title = "Notepad"
Send("#r") ;open run box
;wait for it
WinWait("Run") ;partial match
If Not WinActive("Run") Then WinActivate("Run")
WinWaitActive("Run")
Send($pgm & @CRLF) ;run program
$hWnd = WinWait($pgm_title) ;partial match

;now try to determine PID and name and path of process
$iPID = WinGetProcess($hwnd)
$iThreadID = _WinAPI_GetWindowThreadProcessId($hWnd, $iPID)

MsgBox(0, "Debug", "$pgm_title = '" & $pgm_title & "' PID = " &$iPID & " $iThreadID = " & $iThreadID)

$fn = _WinAPI_GetModuleFileNameEx($hWnd, 0) ;<-- I'm not passing the right parameter
MsgBox(0, "Debug", "full filename of process = '" & $fn & "'")

Exit

[JohnOne]

I forgot about WinGetProcess, and can't remember why I opted for _WinAPI_GetWindowThreadProcessId.

Anyway, here is a basic way to get notepad exe from window.

#include <WinAPI.au3>
#include <WinAPIEx.au3>
#include <APIConstants.au3>

Run("notepad.exe")

$hWnd = WinWait("Untitled - Notepad") ; win handle

$iPID = WinGetProcess($hwnd) ; win process

$hProc = _WinAPI_OpenProcess($PROCESS_ALL_ACCESS,0,$iPID) ;process handle

$fn = _WinAPI_GetModuleFileNameEx($hProc) ; process path

_WinAPI_CloseHandle($hProc) ; close handle

MsgBox(0, "Debug", "full filename of process = '" & $fn & "'")

[guinness]

What's wrong with _WinAPI_GetProcessFileName()?

[BrewManNH]

Jon - "The script writer knows what processes they are using so why try and determine it programmatically?" Not exactly always the case. Let me give you an actual example. I'm not at admin level. I turn on Au3Recorder because I want to generate a script to automate generating a restore point. I move to lower left and right click to bring up commands (because Send("#x") does not work - but that's another issue). Left click on run and type in (or send) "systempropertiesprotection.exe" then click OK. Up pops System Properties and I proceed to click Create, etc. I then stop the script and try running it. It doesn't work for all the reasons above. I need to either run everything at admin level (ugh) or somehow determine programmatically when I need to elevate.

You totally missed the part where I said there's no check that you can possibly make that will allow you to elevate the script with #RequireAdmin, whether you find out whether it's needed or not. #RequireAdmin is executed as soon as the script is run, there's nothing that you can do that will change whether to run it or not. There are other ways to elevate a program you want to run, but #RequireAdmin isn't the way to do it. RunAs/RunAsWait can be supplied the credentials needed to run a process.

[JohnOne]

Probably nothing, and I never seen it, but it does not work for me.

#include <WinAPIEx.au3>
#include <APIConstants.au3>

$fn = _WinAPI_GetProcessFileName(Run("notepad.exe"))

MsgBox(0, "Debug", "full filename of process = '" & $fn & "'")

Nothing short of openprocess with $PROCESS_ALL_ACCESS returns any result.

[guinness]

Strange as this works for me.

#include <APIConstants.au3>
#include <WinAPIEx.au3>

Local $iPID = Run('notepad.exe')
ProcessWait('notepad.exe', 5)
Sleep(2000)

MsgBox($MB_SYSTEMMODAL, '', _WinAPI_GetProcessFileName($iPID))

[JohnOne]

Not for me, not even with admin

[guinness]

Strange, I'm using V3.3.8.1 x64 and the latest version of WinAPIEx v3.8.