The Case of the Notepad that Wouldn't Run

I recently presented a class to Microsoft developers that included a section about Windows Vista's User Account Control (UAC) feature. UAC allows users, even administrators, to run as standard users most of the time, while giving them the ability to run executables with administrator rights when necessary. The following list shows the situations in which executables can trigger a request for administrator rights:

Perhaps the most common need for administrator rights comes from setup programs, which generally can't install properly without write access to HKEY_LOCAL_MACHINESoftware and HKEY_LOCAL_MACHINEProgram Files—two registry locations that only administrators can modify. As an ad hoc demonstration of this, during the presentation I copied WindowsNotepad.exe to my account's profile directory, renaming it to Notepad-setup.exe in the process. Then I launched it, expecting to see a consent dialog box asking me to grant the renamed Notepad administrative rights. To my consternation, no such dialog appeared. In fact, nothing happened, even when I tried again.

You can follow all the steps I performed to diagnose the Notepad startup problem by visiting my blog at https://blogs.technet.com/markrussinovich/archive/2006/10.aspx. In a nutshell, the reason I hadn't been presented with a UAC consent dialog box asking me to give it permission to run with administrator rights is that heuristic setup detection applies only to files that don't have an embedded manifest that specifies a security TrustLevel. Notepad does include a manifest and therefore doesn't trigger the UAC consent dialog box. The reason Notepad didn't execute is that in Vista, executables can have external resource files, and Notepad looks for its resource files in subdirectories beneath it. Because I didn't copy the resource files, Notepad couldn't find them and silently exited.

This is a summary of a popular posting to Mark Russinovich’s technical blog (https://blogs.technet.com/markrussinovich/about.aspx), which covers topics such as Windows troubleshooting, technologies, and security. You can read the entire post at https://blogs.technet.com/markrussinovich/archive/2006/10.aspx.