Run with highestAvailable Execution Level by default

[ferventcoder]

Update 20170606

We have flipped this functionality back to asInvoker with 0.10.7 - see #1324 for details, join the discussion at #1307.

---

See #1054 (comment) for the way to set it back if you need the older functionality.

Where This Applies

HighestAvailable Execution does a good job of only asking for elevation when an administrator is not in an administrative command shell, and only in that scenario. Everything else just continues to work as it normally does.

To be sure it is clear how elevation works in highestAvailable, let's understand the scenarios when elevation will be requested:

• [ ] Admin account in elevated shell
• [ ] Non-administrative account
• [ ] SYSTEM account
• [ ] Built-in administrator account on Server SKUs
• [ x ] Administrator in an non-elevated shell

What about existing automation? Would it need to be changed for this?

Most likely all existing automation is likely to already be okay with highestAvailable anyway based on the scenarios above. Most likely you are either using SYSTEM, a non-admin account, or using an admin with an administrative shell so it doesn't get hit by UAC for other things anyway.

Summary

Try adding an app manifest that will set require admin permissions to see if it overrides the internal file.

Add app.manifest for Chocolatey. When you run Chocolatey, it will ask you to run as administrator if you are an administrator. Unfortunately it doesn't appear you can override this setting with a local manifest file next to the application AND a merged manifest (I could be wrong on this, but I didn't see a way).

Notes

One longstanding request with Chocolatey was to have it always request admin privileges before running. This has been a hope that it would cut down on the accidental runs of Chocolatey in a command shell that is not elevated and needing to open on that was. This UAC (User account control) setting is handled by something called an application manifest (app.manifest). We had it set to "asInvoker", or run with the context of the user that ran the command. We've moved this to "highestAvailable", which means if you are a non-admin, it will just run under your context, but if you are an admin in a non-elevated shell, it will ask for elevated permissions to run. There is also "requireAdministrator", which locks execution down to administrators only.

Moving to "highestAvailable" allows for that asking of privileges that you are used to, up front before it runs. However one additional thing we did here was give you more control over this setting now. We used to embed the app manifest into choco.exe. We now set it next to choco.exe (base install under $env:ChocolateyInstall, you will find choco.exe.manifest) so you have more freedom to adjust those execution levels as you see fit. There is one catch, you will need to do it on every install/upgrade of Chocolatey until #1206 is implemented.

[ferventcoder]

Instructions for non-admin installation will need to be added as well to remove this file.

[ferventcoder]

If this becomes undesirable for some folks, we may need to shift this around a bit for the next version.

[jberezanski]

Yes, this will be undesirable. I wouldn't want choco to prompt for elevation each time I run a query command (info, list etc.).

[ferventcoder]

Will only happen if your prompt is not elevated

[ferventcoder]

@jberezanski still an issue considering it only prompts if you are an admin in a non-elevated context? ^^

I'm assuming this was already understood though so likely. ?

[jberezanski]

Most of my command prompts are non-elevated (this adds safety from fat fingers and security from unexpected actions performed by binary tools downloaded from the net). When I want to run something with admin rights, I just put elevate in front of the command.

So yes, still an issue.

Ideally, choco would ask for elevation only when processing one of the commands that really requires it, such as install (but only when $Env:ChocolateyInstall is not writable already).

[ferventcoder]

Perhaps there is a way to ensure you won't have issues - still exploring this.

[ferventcoder]

Okay found a way. We really need the behavior for most folks to ask that they run with the highest privileges they have. It will also help reduce support tickets and otherwise.

However a good compromise is externalizing the app manifest that Chocolatey uses so that you can decide what to change it to yourself. Also added a lot of documentation here to help folks make the best decision. However there is a catch. Not a big one, but it may be a bit annoying if you do want to change the value - you will need to do it every time you upgrade until #1206 is implemented.

• Find $env:ChocolateyInstall and open that folder.
• There is a choco.exe.manifest file. Open the file.
• Change the line <requestedExecutionLevel> to use asInvoker.
• Save the file and exit the editor.
• You may also need to change the modified date on choco.exe so Windows will pick up the change.

NOTE: This sets choco.exe back to the way it worked in older versions. This means that there is no elevation when starting choco.exe or any of its shims like cpack.exe, clist.exe, etc.

[jberezanski]

It's a reasonable compromise. Hopefully one day Choco will get smart enough to ask for elevation only for actions which require it.

[ferventcoder]

It's a reasonable compromise. Hopefully one day Choco will get smart enough to ask for elevation only for actions which require it.

There are some really complex ways to handle this now, and none of them seem beneficial for the amount of work required to do so (think git model, where every action is its own binary).