Suddenly "needs permission to continue" on Vista - UAC

Discussions related to using VirtualBox on Windows hosts.
Post Reply
PaulS
Posts: 4
Joined: 16. Apr 2009, 11:29
Primary OS: MS Windows Vista
VBox Version: PUEL
Guest OSses: XP

Suddenly "needs permission to continue" on Vista - UAC

Post by PaulS »

... or have I just gone senile and forgotten a magic incantation?

Vista Business + VBox 2.1.4

Tuesday: AFAICR worked normally from a User Account
(as it has for past month or so)

Wednesday: "A program needs your permission to continue"
VirtualBox GUI
Sun Microsystems, Inc

While I didn't think that anything had changed on my machine (Vista auto-update disabled) nor with VBox, when I couldn't find anything relevant on Google I eventually installed all outstanding Vista updates and upgraded to 2.2.0 (then uninstalled and reinstalled - from the Administrator account) But still from a "user account", I get a UAC prompt when I start VirtualBox.exe

(OTOH, since a VM is doing some pretty complicated stuff, perhaps I should be asking why it didn't require UAC from the outset?)

What's even more irritating is that entering an administrator's password doesn't simply run the program at an elevated level - it runs with different credentials (and folders and VirtualBox.XML)

I'd appreciate it if people could confirm whether their Vista always does or does not require UAC - or have any ideas why my system should start behaving differently.

Thanks
Paul
vbox4me2
Volunteer
Posts: 5218
Joined: 21. Nov 2008, 20:27
Location: Rotterdam
Contact:

Re: Suddenly "needs permission to continue" on Vista - UAC

Post by vbox4me2 »

With 2.06 and 2.08 vista does not ask anything, it just starts and runs, UAC fully activated. Is the shortcut not modified to ask for elevation? have you run any vista optimizers?
PaulS
Posts: 4
Joined: 16. Apr 2009, 11:29
Primary OS: MS Windows Vista
VBox Version: PUEL
Guest OSses: XP

Re: Suddenly "needs permission to continue" on Vista - UAC

Post by PaulS »

Hi vbox4me2,
vbox4me2 wrote:With 2.06 and 2.08 vista does not ask anything, it just starts and runs, UAC fully activated.
Thanks for reassuring me that I wasn't imagining that my system used to work like that !
vbox4me2 wrote:Is the shortcut not modified to ask for elevation? have you run any vista optimizers?
"No" and "No" - and if I run VirtualBox.exe directly from a command prompt, I still get the UAC prompt.

Tuesday evening: Everything Tickety-Boo.
Wednesday morning: "More than my Job's worth to let you run that program"
--- I did check to see that the date wasn't April 1st

(Off to waste another few hours in Google to see if I there's any way to identify *why* a UAC prompt has been raised - but I suppose if they gave any reason it would compromise "security")
vbox4me2
Volunteer
Posts: 5218
Joined: 21. Nov 2008, 20:27
Location: Rotterdam
Contact:

Re: Suddenly "needs permission to continue" on Vista - UAC

Post by vbox4me2 »

Maybe windows defender? you did do alot of updating that its nearly impossible to find out who to blame...
PaulS
Posts: 4
Joined: 16. Apr 2009, 11:29
Primary OS: MS Windows Vista
VBox Version: PUEL
Guest OSses: XP

Re: Suddenly "needs permission to continue" on Vista - UAC

Post by PaulS »

No, I have Windows Defender turned off (for better or worse we use Sophos)

And, as I said, updating and reinstalling was my last throw - the UAC prompts started before I (think) I'd changed anything.

And now although the other VMs I've upgraded seem perfectly happy, my most important (development) VM Blue-Screens on startup :(
vbox4me2
Volunteer
Posts: 5218
Joined: 21. Nov 2008, 20:27
Location: Rotterdam
Contact:

Re: Suddenly "needs permission to continue" on Vista - UAC

Post by vbox4me2 »

Go back to 2.1.4 until all the issues with 2.2 are resolved, search here on howto's if 2.2 doesn't want to rollback.
PaulS
Posts: 4
Joined: 16. Apr 2009, 11:29
Primary OS: MS Windows Vista
VBox Version: PUEL
Guest OSses: XP

Re: Suddenly "needs permission to continue" - SOLVED!

Post by PaulS »

(I hope!)

RegEdit showed both VirtualBox and VBoxSvr had a compatability setting: RUNASADMINISTRATOR.

Removing these keys from the Registry restores the original (non-UAC) behaviour - Although I would have sworn that I hadn't changed these settings until /after/ the UAC prompts had started appearing (why would I have wanted to?) after rereading the notes from my initial 1.5.6 installation, perhaps I did wrongly apply this old work-round too liberally.

>> Your COM server VboxSvc.exe must be set to run as administrator.
>> Open your Virtualbox folder, Right-click Vboxsvc.exe, properties “run as administrator”


In the hope that this might save someone from hours of Googling when trying to track down Vista UAC problems, I'll post some notes here...

I found a (probably simplified) description of how Vista UAC decides if it needs to raise a prompt...

"First Vista checks for the presence of an embedded manifest. If there is one and it specifies a requestedExecutionLevel, Vista uses that to determine whether or not to elevate via UAC."

Looking at the embedded manifest with SysInternal's SigCheck...

C:\Program Files\Sun\xVM VirtualBox>sigcheck -m VirtualBox.exe
Verified: Signed
Signing date: 20:25 07-Apr-09
Strong Name: Unsigned
Publisher: Sun Microsystems, Inc.
Description: VirtualBox GUI
Product: Sun VirtualBox
Version: 2.2.0.r45846
File version: 2.2.0.r45846

...No mention of "RunAsAdmin" privilege there!


"Secondly, assuming there was no embedded manifest at all, Vista looks for an external manifest file with a requestedExecutionLevel. If that exists, Vista uses it to decide whether or not to elevate via UAC."

That should be a N/A - and there's no external manifest anyway.


"If we reach the third stage, Vista has determined that the application is not Vista compliant and so starts using the Application Compatibility settings to determine whether or not elevation is likely to be required. Predominantly this is based on an appcompat flag that indicates elevation is required (equivalent to the "Always run the program as an Administrator" flag in the Compatability settings) and detection of known binaries which have identified issues."

By my reading, we shouldn't "reach the third stage", but Explorer, right-click on "VirtualBox.exe", Properties, Compatability, and the "Privilege Level / Run this program as an Administrator" option is indeed checked - and greyed-out.

Back to Google to see why that option might be greyed...

"If the file has a Windows Vista manifest identifying the level of privilege required then the compatability options will be greyed out."

Well, SigCheck says it does have a manifest but that doesn't identify any privilege.


"Vista will attempt to identify installers and prompt you for elevation (indicated by the small shield overlay icon)."

And squinting at the icon - yes, it does have a teensy little shield on both VirtualBox and VBoxSvc that my ageing eyes hadn't noticed before.

"There is also an appcompat feature known as installer detection. This uses a variety of non-disclosed settings to attempt to identify installers and elevate them if required. The specifics of how an installer is detected is not disclosed because it's not something Microsoft want you to depend upon and indeed it may change as Service Packs and hotfixes are released."

"Non-disclosed" won't help me to fix it. But since no other Vista-host user is reporting errors, maybe the problem is with my compatability options...

RegEdit - HKLU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

...AHA!
wittelw
Posts: 1
Joined: 12. Nov 2009, 18:44
Primary OS: MS Windows 2008
VBox Version: OSE other
Guest OSses: Windows 7

Re: Suddenly "needs permission to continue" on Vista - UAC

Post by wittelw »

FWIW on Windows Server 2008 I was able to give my user account (also an admin) full permissions for the default <username>\.VirtualBox directory (I have cygwin installed so that's probably why that directory got picked), and to a new directory I designated as default and things seem to work fine with no prompts.

Don't know if this is best practice, but I don't mind my user account having full permissions to these directories.
Post Reply