How to prevent program from running as an Administrator [thus have it on the same lev

[Wineroz]

I have finally found the solution

In my case all it took was to add this simplistic change to the Registry

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers]
"C:\\Program Files (x86)\\Sony\\Sound Forge 7.0\\forge70.exe"="RUNASINVOKER"​ 

[llandyw]

Looks like this forum goes by how many posts have been made to determine "junior" vs "senior" members. Been here since 2002, and still am listed as "junior".

[Wineroz]

Thank you for this thorough explanation

[llandyw]

Consider that this is the preferred way to set the permissions. Also, it attaches the permission levels directly to a resource within the executable itself. No need for a shortcut, or editing the registry. Also, the permissions will follow the exe file itself.

For example, if you were to move Winamp out of one of the program files folders, such as if you want it to be able to write to it's own .ini file, the permissions will follow it. The registry edit would require you to go back in and change the path.

Although, there's yet another way to let it run at normal (invoker) permissions, AND have it NOT in the program files folder, yet appear to be there.

Move the Winamp folder to another location (I use a folder called "nosec" in the root of the C: drive. Move the whole folder.

Next, open a command window and (using my bits as an example), type:

mklink /j "C:\Program Files\Winamp" "C:\nosec\Winamp"

This will create a junction in the Program Files folder. But since the actual Winamp folder is in a different folder, the Program Files folder permissions will no longer be inherited by the Winamp folder as it's not actually in the Program Files folder. Windows will automatically reparse anything using the Program Files\Winamp folder, to point to the other one.

mklink is a Windows command line program that comes with Windows, so no need to even get the Windows SDK.

All this is stuff I have actually done. I wrote an installer that uses XML for it's instructions, and both the manifest tool and junctions were used for the stuff that needed to be installed.

This last item is probably the very best way to do it since the permissions in the program files folder are what makes it so Winamp needs admin, just to write to it's own files.
This gets around that issue completely.

I have 2 other programs in my nosec folder. An emulator for another computer, and MP3 Manager 32. Both need write access to their own ini or data files files, and this allows it by creating a junction for whatever needs to be elsewhere.

SO, take your pick. If you do the registry edit, Winamp still won't be able to write to it's own files. You'd have to get the properties of the Winamp folder, click the security tab, then Advanced.
From there, click Disable Inheritance. Then add a username to the list, and set full control to that user, or use user "everyone" to allow any user to run Winamp and let you make settings changes, then select the checkbox so permissions propagate to the other files/folders within the Winamp folder. This isn't a good way to do it, but it will work as well.

[Wineroz]

There's a better way of setting the security levels of ANY program. Create a manifest
[...]
Remove the lines that
[...]
Download and install the
[...]
attach the manifest to an application
[...]

Thank you for sharing an alternative way - but in what way is it better with all those necessary steps?

Registry is already built-in and all anyone has to do is to change PATH and PROGRAM in the REG file- in theory that is. So is your way supposedly better because mine may not always work, while yours is suppose to work no mater what?

[llandyw]

There's a better way of setting the security levels of ANY program. Create a manifest (in this case, winamp.manifest and place the proper information in it.

Remove the lines that don't apply to the level you want. Download and install the Windows SDK from Microsoft. In it, you will find an executable by the name of MT.exe This is the manifest tool that will attach the manifest to an application. Syntax is mt -manifest manifestname - in this case, MT -manifest winamp

Again, make sure to remove the "requestedExecutionLevel" lines you won't be needing.

---

<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<!-- remove unused requestedExecutionLevel lines -->
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>

<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application> </application>
</compatibility>
</assembly>

[Wineroz]

I have finally found a working solution - in form of a REG hack:

code:
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers]

C:\\PATH-TO-YOUR-PROGRAM\\THE-EXE-FILE.exe"="RUNASINVOKER"

[Wineroz]

I am still waiting for an answer

[Wineroz]

I had the same problem. A reinstall fixed it.

For what software did it work for you? And you over-installed it on already exiting installation of it - or did you first removed it?

For me installing over did not work - my Sony Sound Forge 7.0 is still elevated

[julianpa]

I had the same problem. A reinstall fixed it.

[Lenneth]

Easiest way is probably to remove it and reinstall. If it still asks for elevated privileges then it might be that it only functions at that level.

[Wineroz]

I have this very old audio editor [from 2003] than for not apparent reason runs itself as an Administrator. And this I know because I can see it under the

code:
Task Manager > Details > Elevated

And [long story short] apparently this causes problems with some other programs trying to cooperate with it. And If I change those others programs [including Winamp] to being run as elevated, then new problems show up - so it is not a workaround that I can really use



So my question is: how do I stop this audio editor from being elevated? So that I can retain combo of my audio related pieces of software fully working?



I have tried going to its EXE and turning for it ON & OFF [as it was set to OFF in the first place] the

code:
Properties > Compatibility > Settings > Run this program as an administrator

option, but it did not reset that EXE. Also renaming the EXE did not foul the operating system


I am using Windows 10 Enterprise 20H2 19042.746