Old 21st June 2007, 15:21   #1
hotkebab99
Junior Member
 
Join Date: Jun 2007
Posts: 2
Change user to administrator

Hello,
I am a French user of NSIS so excuse me for my English

In my society, each person has got an user account on Windows 2000 without administrator rights.

I want to give them a NSIS installer which will modify registry keys so this installer must be running with administrator rights. The problem is that users don't have the right to modify registry keys. Only administrator account got then.

Is it possible in the installer script to give to the installer the administrator password and tell him to use the administrator account with this password ? With this, the installer will run under administrator so registry keys will be modified.

Do you have any solution to my problem ?

Thank you very much !
hotkebab99 is offline   Reply With Quote
Old 21st June 2007, 21:51   #2
sgiusto
Member
 
Join Date: Mar 2007
Location: Italy
Posts: 99
ctrl+right click the installer exe and choose execute as?
or put the installer exe in a cmd file with the runas command?
sgiusto is offline   Reply With Quote
Old 25th June 2007, 08:55   #3
hotkebab99
Junior Member
 
Join Date: Jun 2007
Posts: 2
Quote:
Originally posted by sgiusto
ctrl+right click the installer exe and choose execute as?
or put the installer exe in a cmd file with the runas command?
Of course...
But the interest is that all users of my company (even those who don't have a lot of knowledge in computer) can receive an installer (a patch for a program for example) and can execute it in administrator mode whitout giving them the admin password.
How to do that with NSIS ?
hotkebab99 is offline   Reply With Quote
Old 25th June 2007, 19:56   #4
kichik
M.I.A.
[NSIS Dev, Mod]
 
kichik's Avatar
 
Join Date: Oct 2001
Location: Israel
Posts: 11,343
You're talking about privilege escalation. An ability for every program to do such a thing would result in total chaos, giving everything and everyone administrator privileges on your computer. It'd be considered a serious vulnerability.

If you want to implement such a mechanism, you will have to write a service that'd run on each of your company's computer and have your installers communicate with it for getting administrator privileges. To keep it safe, you'll probably want to digitally sign every installer and verify that signature in your service.

There might be a service already available that does this. I think MSI has such a capability for signed installers.

NSIS FAQ | NSIS Home Page | Donate $
"I hear and I forget. I see and I remember. I do and I understand." -- Confucius
kichik is offline   Reply With Quote
Old 25th June 2007, 20:33   #5
helix400
Member
 
Join Date: Oct 2003
Posts: 51
Heh, you have a tough situation.

The UAC plugin can elevate the NSIS installer process from standard user rights to admnistrator user rights. Provided:

1) An adminstrator account exists with a password. (There must be a password. It cannot work without a password).
2) You are comfortable giving that adminstrator password to standard users.

http://nsis.sourceforge.net/UAC_plug-in

But it sounds like you want to give standard users installers that can have administrator rights without having to type in a password.

If this is the case, then the MSI installer is probably the way to go, as it is designed specifically for these scenarios.
helix400 is offline   Reply With Quote
Old 25th June 2007, 20:36   #6
helix400
Member
 
Join Date: Oct 2003
Posts: 51
Further, one other option is to set up a system where the users don't update their own software, but rather, YOU deploy the updates to the users for them.

I don't work in large scale, enterprise environments, but I hear people discuss doing this all the time.
helix400 is offline   Reply With Quote
Old 17th July 2007, 15:18   #7
psyki
Junior Member
 
Join Date: Jul 2007
Location: Belgium
Posts: 7
yes, those are MSI packages
psyki is offline   Reply With Quote
Reply
Go Back   Winamp & Shoutcast Forums > Developer Center > NSIS Discussion

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump