Run child process non-elevated from an elevated/As Admin process

Question

My application has a built-in self update system via another app called \"updater.exe\" which is in the same folder with the main application to update. It downloads the new

Answer 1

One way to "de-elevate" a child process is to start it via Explorer. This should generally work with normal Win users. But if Explorer itself is running elevated, then so will the app you are trying to start. Explorer may be running elevated because:

• The active user is Admin (not just a user with admin privs)
• Explorer.exe was (re)started from a command window which...you got it, is running elevated

... and probably others.

Its better to think of this as starting the app with default rights. If running elevated Explorer will start the new instance elevated, but original first Main App instance would also have run elevated.

Test code to start the same app using a checkbox to select elevated or not:

Dim proc = New Process
proc.StartInfo.UseShellExecute = True
proc.StartInfo.WindowStyle = ProcessWindowStyle.Normal
proc.StartInfo.WorkingDirectory = mypath

If chkAdmin.Checked Then                    ' run this app as admin
    proc.StartInfo.FileName = myApp
    proc.StartInfo.WorkingDirectory = mypath
    proc.StartInfo.Verb = "runas"           ' run "me" as admin
    proc.StartInfo.Arguments = ""
Else                                        ' run explorer w/app as arg
    ' de-elevate new app instance to run de-elevated
    proc.StartInfo.FileName = Path.Combine(windir, "explorer.exe")  
    proc.StartInfo.Verb = ""                ' important!
    proc.StartInfo.Arguments = myApp        ' send the child app name as arg
End If

proc.Start()

This image shows the result:

The label at the top of the form indicates whether that app is running elevated, each app instance was started by the one before it.

The second window down is running elevated. When it started the next instance, the check box for As Admin wasn't checked; as a result the 3rd instance was started via Explorer and is not running elevated. Same for #4 starting #5.