Windows Development

djdynamix wrote:

4) Create a task in Task Scheduler to run the app with administrator permissions. This is impractical because the machine administrator password has to be written into the task.

djdynamix wrote:

Unfortunately, the "Do not store password" option probably won't work, because it will then request an admin password whenever the app is started.

Task Security Context[^]:

If you select the checkbox labeled Do not store password , Task Scheduler will not store the credentials supplied on the local computer, but will discard them after properly authenticating the user. When required to run the task, the Task Scheduler service will use the "Service-for-User" (S4U) extensions to the Kerberos authentication protocol to retrieve the user's token.

When using S4U the ability of the service to use the security context of the account is constrained. In particular, the service can only use the security context to access local resources.

   <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
      <security>
         <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
            <!-- UAC Manifest Options
            If you want to change the Windows User Account Control level replace the 
            requestedExecutionLevel node with one of the following.

<pre>
    <requestedExecutionLevel  level="asInvoker" uiAccess="false" />
    <requestedExecutionLevel  level="requireAdministrator" uiAccess="false" />
    <requestedExecutionLevel  level="highestAvailable" uiAccess="false" />

        Specifying requestedExecutionLevel node will disable file and registry virtualization.
        If you want to utilize File and Registry Virtualization for backward 
        compatibility then delete the requestedExecutionLevel node.
    -->
        <requestedExecutionLevel  level="requireAdministrator"
                                  uiAccess="false" />

     </requestedPrivileges>
  </security>