Vista - Update an app in Program Files, without Admin privs?

[-Monkey-]

Hi,
In a corporate environment, I need to regularly update an application exe file that's stored in its folder under C:\Program Files\<appfolder>.

I know that when an app writes to, e.g., an ini file, the ini file is virtualised in the user's VirtualStore\Program Files\<appfolder> . However, what if I want to update the application exe file? I need some kind of cheat in order to do this via the user's login.

Updating the exe in its normal location, via Admin privs, is not an option, as users' PCs are heavily locked down and I can't get Admin privs. Under Win2K, I could easily update the exe by using a .bat file I sent to the user, which would just overwrite the old exe in its folder (as the user had modify privs to the app's folder). This is now not possible under Vista (thanks MS! I know you're trying to teach us 'best practice' here, but please don't ram it down my throat like this - the real world ain't black & white, anarchy is sometimes necessary).

Having a separate 'Vistafied' version of the app is not an option for me either, for now at least (please don't ask why - it's a very long answer!).

So, I thought maybe the following 'cheat' would work, though I'm not in a position to try it for myself just yet, as that would be lots of hassle to get done (another long story, as is everything in this environment - don't ask!), so would like to know beforehand whether it stands a chance.

My proposed 'cheat' is:-

1) A 'loader' app is launched by the user, which attempts to increment (or whatever) a dummy (unused) byte in the main app exe file (in C:\Program Files\<appfolder> , but effectively modifies the virtualised copy instead), then in turn launches that (virtualised) main app.

2) (this step only when an update is needed) I send the user a batch (.bat) file, which, while the app isn't running of course, copies the new main app exe file into the VirtualStore, overwriting the one already in there.

3) Back round to step 1. Each time the loader app is run, the main app exe is read from, and effectively written back to, the VirtualStore.... and so on....

Would/should this approach work? Or am I missing something? Thinks maybe I've confused myself here?

Your thoughts & comments would be most appreciated.

Thanks for reading, and any help you might give.

[EINSTEIN_007]

Found a link which might assist you.

[newtech]

Rather than logging out of your current account and logging in as an Administrator, you can use the same process from your current account. The way I usually force a program to do this is:

Right-click on the shortcut, select Properties.
Select the “Compatibility” tab
Click the button at the bottom “Show settings for all users”
At the UAC prompt, enter the administrator credentials.
On the new properties window, checkmark the “Run this program as an administrator”.
Click OK, and OK again.
The next time this program runs, the UAC will prompt you for your administrator username/password.

I find this useful for a few programs that require access to other folders in the “Program Files” directory, like my video conversion software. It isn’t allowed to update any files without administrator privileges.

Also, an important Vista note - when you install a new program, you are sometimes prompted at the end of the install process to run the newly installed software. You want to be careful about allowing that, because if you’ve given the installer admin privileges (most likely), telling it to launch the new program will launch it with the same admin privileges, rather than your current user account. Rather, you want to end the installer and run the program via a shortcut instead.

[-Monkey-]

Thanks for the replies folks. However, I'm afraid the advice doesn't help in the situation I'm in. As I said in the original post, I cannot obtain Admin creds for any of these locked down machines, otherwise I wouldn't have the problem in the first place.

In this huge company, all the IT is controlled centrally by the IT division. When one of the group's businesses wishes for some of its users to run an app that isn't part of the group-wide standard PC rollout, the app has to go through a long process first (grits teeth!). The app installer has to be submitted to them for 'scripting' - so that it doesn't mess up the standard config in any way. This scripting process can take anything from 2 weeks to 2 months, or worse

Each time the app is updated by the vendor, the scripting process has to be gone through over again - not condusive to getting things done quickly. When the app in question is under continuous development, as per this one, the process becomes a real hindrance. I provide limited support only for the specific app - I'm not part of the IT division, hence no Admin privs.

In a smaller company, you can have a chat with Tom, Richard or Harry in the server room and get things done pretty quickly. Here, you're forced to go through strict processes (lots of request forms, emails, testing etc...) to do the same. A necessary evil - the dog must wag the tail.

In the past, on the W2K platform, any special app that has been scripted allows the assigned user full modify privs on the relevant app's folder, in order that e.g. user prefs (in ini files) can be updated without any special access controls. So, I could roll out say a bug fix instantly to the user, simply by copying the updated exe to their PC. Not with Vista I can't. UAC would be a solution but requires Admin access to set up, so no good here. Current group policy does not provide for it, and I won't hold my breath for that.

The rules have to be rigid, as the locked down machines (100s of thousands of them) must adhere to a standard configuration. Users can install nothing, except via the officially managed installer process (i.e. scripted apps). There is no Add/Remove programs option - all scripted apps have to be installed by the assigned user by means of the custom installer tool that's part of the standard config.

Gone are the days when users were allowed to install their own screensavers etc. I've lost count of the times users ask me why they can't e.g. run a demo CD or get a particular memory stick to work on their PCs. The answer is always the same - " ... if you want to run this thing on your
machine, its software/driver installer will need to be scripted first" ( ).

I wondered if the cheat I suggested earlier would get round this limitation in Vista, so I can continue to update the app exe as and when I like, a la W2K, without the need to first go through the normal scripting processes over again.

I believe the proposed solution would not compromise the machine's standard security configuration or integrity, since it would (I hope) be within the bounds of what's possible. On the company's PCs, whatever is possible to do is normally OK. If it's not OK, it will have been made impossible by the IT division - rest assured!

At the moment, I could well do with knowing in advance whether the plan would work, as trying it out would involve getting the app vendor to code for it in the first place - do-able but not quick and easy. If it doesn't work first time, it's back round the scripting loop again...

Hope this explains more.