“asInvoker”和“asInvoker”有什么区别？和“最高可用”执行水平？
的区别是什么。
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
我一直想知道嵌入和
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
应用程序清单中
I've been wondering what the difference between embedding
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
and
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
in your application's manifest is.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这是 MSDN 上的描述：
基本上，“asInvoker”将使用用户的默认安全设置。它被描述为“应用程序使用与父进程相同的访问令牌运行。”，这意味着相同的安全令牌用作调用进程，通常是桌面 shell（或启动它的进程，如果您启动来自另一个程序的应用程序）。
使用“highestAvailable”将导致应用程序使用用户可以获得的最高权限运行。例如，如果他们是管理员，他们将收到 UAC 提示，并且应用程序将以管理员权限运行。但是，如果他们是普通用户，他们将获得正常的安全设置等。
一般来说，除非您有特定原因请求更多权限，否则您将需要使用“asInvoker”。
This is described on MSDN:
Basically, "asInvoker" will use the user's default security settings. It's described as "The application runs with the same access token as the parent process.", which means the same security token is used as the calling process, which is typically the desktop shell (or the process that launches this, if you launch your app from another program).
Using "highestAvailable" will cause the application to run using the highest priveledges the user can obtain. If they're an administrator, for example, they'll get a UAC prompt and the app will run with admin rights. However, if they're a normal user, they'll get normal security settings, etc.
In general, you'll want to use "asInvoker" unless you have a specific reason to request more rights.
“最高可用”的一个很好的例子是备份操作员组的成员。
从 Windows Vista 开始，不仅仅是“管理员”被剥夺了权限并被授予分割令牌。系统会查看您是否：
因此，如果您是备份操作员组的成员，您的安全令牌将被过滤，就像过滤备份操作员组的成员一样。 strong>管理员组。
来自 MSDN 杂志文章：
如果我创建一个备份用户，我需要使用返回给我的备份相关权限来运行：
这意味着我不需要（或希望）以成熟的管理员身份运行。我想以我的最高可用权限集运行。
这是 requestedExecutionLevel 的三个选项开始出现的地方：
asInvoker：应用程序将以与启动它的进程相同的权限运行。通过选择以管理员身份运行，可以将应用程序提升到更高的权限级别。
highestAvailable：应用程序将以它可以的最高权限级别运行。如果启动应用程序的用户是管理员组的成员，则此选项与 requireAdministrator 相同。如果最高可用权限级别高于打开进程的级别，系统将提示输入凭据。
requireAdministrator：应用程序将以管理员权限运行。启动应用程序的用户必须是管理员组的成员。如果打开进程未以管理权限运行，系统将提示输入凭据。
额外阅读
A good example of "highest available" is someone who is a member of the Backup Operators group.
Starting with Windows Vista, it is not just "Administrators" who are stripped of their privileges and given a split-token. The system looks to see if you are:
So if you are a member of the Backup Operators groups, your security token is filtered exactly like it is for members of the Administrators group.
From MSDN Magazine article:
If i create a backup user, i need to run with my backup related privileges returned to me:
That means that i don't need (or want) to run as a full fledged Administrator. I want to run with my highest available set of permissions back.
This is where your three options for requestedExecutionLevel start to come out:
asInvoker: The application will run with the same permissions as the process that started it. The application can be elevated to a higher permission level by selecting Run as Administrator.
highestAvailable: The application will run with the highest permission level that it can. If the user who starts the application is a member of the Administrators group, this option is the same as requireAdministrator. If the highest available permission level is higher than the level of the opening process, the system will prompt for credentials.
requireAdministrator: The application will run with administrator permissions. The user who starts the application must be a member of the Administrators group. If the opening process is not running with administrative permissions, the system will prompt for credentials.
Bonus Reading