软件更新和UAC
Windows 如何处理安全和软件更新？我需要将软件部署到多台计算机上，并且会定期更新。更新只是下载并运行新的安装程序。显然，对于初始安装，管理员需要运行安装程序，但之后安装程序是否会被列入白名单，以非管理员身份运行？适用于 XP 和 7。安装程序是使用 WiX 生成的 msi。
How does Windows handle security and software updates? I need to deploy software to several computers, which will be regularly updated. The update just downloads and runs the new installer. Obviously for the initial installation an administrator needs to run the installer, but after that is the installer white-listed to be run as a non-administrator? This is for XP and 7. The installer is an msi generated with WiX.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不，安装程序未列入白名单。即使是，更新也是另一个安装程序。所以你的问题的答案是：用户必须在 UAC 提示中确认提升。
Firefox 和 Opera 就是例子。每次准备安装更新时，更新程序都会显示 UAC 提示。另一方面，Chrome 更新时没有 UAC 提示，只是因为它安装到没有写保护的用户配置文件中（我的意思是当前用户拥有完整的权限）。
Firefox 计划实施一项服务来促进更新过程。该服务在系统权限下运行，它可以以系统权限启动更新程序，而无需用户同意提升，因为它已经拥有系统的完全访问权限。这就是防病毒软件自我更新的方式。通常有两个进程：服务和显示 UI 并与服务通信的客户端。
对于 MSI，有系统策略。例如，您可以启用一项策略，根据该策略，任何基于 Windows Installer 的安装都会以提升的方式运行。通常补丁（次要更新）会以提升的方式运行。可能存在一项控制主要更新的策略（卸载旧版本，然后安装新版本），但我不知道这一点。
No, the installer is not white listed. Even if it were, the update is another installer. So the answer to your question: users will have to confirm elevation in UAC prompt.
Firefox and Opera are the examples. Every time an update is ready to be installed, the updater shows UAC prompt. Chrome on the other hand updates without UAC prompt, simply because it installs into user's profile which is not write-protected (I mean current user has full rights).
Firefox plans to implement a service to facilitate the update process. The service runs under system privileges, it can start the updater with system privileges without user consent for elevation, because it already has full access to the system. This is how antivirus software updates itself. Usually there are two processes: the service and the client which displays UI and communicates to the service.
In the case of MSI, there are system policies. For example, you can enable a policy according to which any Windows Installer-based installation will be run elevated. Usually patches (minor updates) are run elevated. There may exist a policy which controls major updates (where the old version is uninstalled and then a new one is installed), yet I am not aware of such.
我不了解 WiX，但可以为现有安装程序包生成 .msp 补丁。如果使用 MsiPatchCertificate 表正确填写 MSI，则可以在修补时避免提升。
更多详细信息，请访问 MSDN：用户帐户控制 (UAC) 修补，< a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ee418715%28v=vs.85%29.aspx" rel="nofollow">在 Windows XP、Windows Vista 和 Windows 7 中修补游戏软件
I don't know WiX, but it is possible to generate an .msp patch for your existing installer package. If the MSI is properly filled out with an MsiPatchCertificate table, you can avoid elevation when patching.
More details here at MSDN: User Account Control (UAC) Patching, Patching Game Software in Windows XP, Windows Vista, and Windows 7