windows 7-64bit - win32 api 牺牲（降级）程序的管理权限
我有一个创建临时文件的程序。如果此程序以具有提升权限的管理员身份运行，则即使用户是管理员，在没有“提升”权限的情况下也无法删除生成的文件。这迫使用户始终以“以管理员身份运行”运行应用程序
。该程序实际上不需要任何管理权限或提升的权限。是否有一种编程方式来确保应用程序始终以正常权限运行？
I have a program that creates temporary files. If this program run as administrator with elevated privileges the resulting files cannot be deleted without "elevated" privileges, even if the user is administrator. This forces the user to run the application always with "Run as administrator"
The program does not really need any administrative rights or elevated privileges. Is there a programmatic way to ensure that the application is always run with normal permissions?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
清单可以指示 Windows 以 Invoker 身份启动应用程序，但如果用户右键单击并选择以管理员身份运行，则应用程序将被提升。我很想通过用户教育来处理这个问题，但是你可以做一些程序化的事情 - 由你来决定是否值得。您可以检查您是否正在运行提升（基本上，当且仅当应用程序提升时，IsInRole 才会说用户是管理员），如果不是，则启动另一个未提升的进程（我确信存在问题这里显示了这一点，但这里有一些我碰巧写的博客文章，链接到执行此操作的方法 native 和 托管）创建实际文件。
A manifest can direct Windows to launch the app asInvoker, but if a user right-clicks and chooses Run As Administrator the app will be elevated. I'd be tempted to handle this through user education, but there is something programmatic you can do - it's up to you to decide if it's worth it. You can check to see if you're running elevated (basically IsInRole will say the user is an admin if and only if the app is elevated) and if you're not, launch another process non-elevated (I am sure there are questions here showing that, but here are some blog entries I happened to write linking to ways to do it native and managed) that creates the actual files.
不，您不能强制程序在没有提升的情况下运行，尤其是在代码中，因为提升发生在任何代码运行之前。如果用户希望应用程序运行 Elevated，那么它将运行 Elevated。但是，您可以做的是让您的应用根据需要创建其文件，并简单地使用
SetFileSecurity()或SetNamedSecurityInfo()来确保所有用户不受限制的访问。有关详细信息，请参阅 http://support.microsoft.com/kb/102102。No, you cannot force the program to run without elevation, especially in code as Elevation occurs before any code is run. If the user wants the app to run Elevated, then it will run Elevated. What you could do, however, is have your app create its files as needed and simply use
SetFileSecurity()orSetNamedSecurityInfo()to ensure unrestricted access for all users. See http://support.microsoft.com/kb/102102 for more info.