WinUI application running as Administrator?

Question

I'm trying to write a WinUI 3 desktop app the requires the Administrator role. It does some msiexec work on behalf of the user, and this pretty much demands being admin as far as I can tell.

The app itself will be an unpackaged ( <WindowsPackageType>None</WindowsPackageType> ) and self-contained ( <WindowsAppSDKSelfContained>true</WindowsAppSDKSelfContained> ). Both of these settings are in the.csproj file.

To try and get Administrator role, I've added this to the app.manifest file:

<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
  <security>
    <requestedPrivileges>
      <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
    </requestedPrivileges>
  </security>
</trustInfo>

as part of the application element. I understand that this should be sufficient to ensure that either the application is being run "as Administrator", or pops up the UAC dialog to request such permissions.

To check whether we are indeed running as Administrator, I've added this function which is called to check on admin status:

    public static bool IsAdmin()
    {
        var identity = WindowsIdentity.GetCurrent();
        var principal = new WindowsPrincipal(identity);
        return principal.IsInRole(WindowsBuiltInRole.Administrator);
    }

• If I build my app and run it outside of Visual Studio, it reports that it is not running as Administator. No UAC, just runs the app as a standard user (if that's the correct terminology).

• If I right-click and select the Run as administrator option, then the app runs and reports that it is running as Administrator.

• If I run it in the Visual Studio debugger, it's always running as Administrator. But I do run Visual Studio as admin, so maybe it's just picking that up from the parent process. Not sure.

So the question is why does just running the app normally neither run as Administrator, nor pop up the UAC dialog to elevate itself to that state? Am I doing something fundamentally wrong in the app.manifest file? Should it work?

Very much a novice when it comes to manifests, C#, WinUI etc, so please be patient if I'm making invalid assumptions or I don't quite understand your answer. Happy to fill in any blanks that I've missed.

Answer 1

I'm not sure if elevated unpackaged apps are supported at the latest WinAppSDK v1.2. But dropping WindowsApSDKSelfContained seems to work.

This is what I tried:

1. Create a plain WinUI 3 app and make it unpackaged. (No self-contained)

<WindowsPackagedType>None</WindowsPackagedType>
<!--<WindowsAppSDKSelfContained>true</WindowsAppSDKSelfContained>-->

2. Edit Package.appxmanifest.

<Capabilities>
  <rescap:Capability Name="runFullTrust" />
  <rescap:Capability Name="allowElevation" />
</Capabilities>

3. Edit app.manifest.

<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
  <security>
    <requestedPrivileges>
      <requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
    </requestedPrivileges>
  </security>
</trustInfo>

4. Add your code to check if it's running as administrator. MainWindow.xaml

<Window
    x:Class="ElevationTest.MainWindow"
    xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
    xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
    xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
    mc:Ignorable="d">
    <Grid>
        <TextBlock x:Name="AdministratorStatusTextBlock"/>
    </Grid>
</Window>

MainWindow.xaml.cs

using Microsoft.UI.Xaml;
using System.Security.Principal;

namespace ElevationTest;

public sealed partial class MainWindow : Window
{
    public MainWindow()
    {
        this.InitializeComponent();
        AdministratorStatusTextBlock.Text = IsAdmin() is true
            ? "Running as admin."
            : "NOT running as admin.";
    }

    public static bool IsAdmin()
    {
        var identity = WindowsIdentity.GetCurrent();
        var principal = new WindowsPrincipal(identity);
        return principal.IsInRole(WindowsBuiltInRole.Administrator);
    }
}

5. Build in Release mode and run the created *.exe file.

The app should ask for permission and the text should show "Running as admin.".