Vista and SpamButcher - The Joy of Security Elevation (Part 2)

(Back to Part 1...)

Windows Vista introduces some unique kinks to the setup process for applications.

By default setup programs aren't given full permission to access the system. Users in the administrator group need to manually confirm that a setup app should get admin rights. The installer will then run under their user profile with full rights.

Non-admin users can opt to enter in the username / password of an administrative user. In this case, the setup process literally runs in the context of the administrative account as opposed to granting admin rights to the non-privileged account.

This process is known as UAC (User Access Control) Elevation. While offering a more secure system, it also introduces some complications.

Once a setup program is running in the context of an administrator, any tasks it launches run under the same user with the same rights that the setup process started with.

Like a lot of install programs, SpamButcher setup automatically runs the application after it's installed. This eliminates one more possible opportunity for the user get off-course during the trial process. See a problem here?

If a non-admin user (let's call him Bob) installs SpamButcher using UAC elevation (perhaps with an account called Root), and then configures SpamButcher after the setup program launches it, any settings Bob configures will be made to Root's profile, not Bob's.

Once Bob re-launches SpamButcher, any accounts he setup or messages the spam filter caught will be missing.

This obviously would make for a bad user experience. Fortunately, most users will probably run with accounts that have admin rights. By default, the first account you create in Vista is an admin.

Still this is a problem that needed to be addressed. We considered a few options.

Skip automatically running SpamButcher after setup

Use a hack to force Vista to initiate a non-elevated task (SpamButcher) after setup

Force a reboot after installing - then launch SpamButcher after rebooting

Create a bootstrap application that launches setup and then the actual application

This is Microsoft's recommended solution, but we hit some technical snags early on. We may revisit this approach later.

Disable installation of SpamButcher for non-administrative accounts

This effectively forces Vista to behave like Windows XP. While some users may be annoyed by this, it prevents the problems of missing accounts and spam emails - which are far more alarming.

It seems likely MS's recommended approach of creating a bootstrapper is a better long-term solution. We will almost certainly re-investigate the entire issue as over time Vista's base of installed users grows.

Back