1

I noticed that while using pip to install packages globally, the install failed with an insufficient permission error. When running pip as administrator, the problem was fixed and pip was able to write to my Program Files directory. The same behavior occurs when editing text files in Program Files -- it only works if I run the text editor as administrator.

However, far as I know, I have never run any installer programs as administrator, yet they all wrote to my Program Files directory without any kind of prompt. What allows these installers to bypass the security check?

(I do have UAC disabled, but if that's the cause then why can't pip and other normal programs like text editors write to the Program Files directory?)

Andrew Sun
  • 113
  • 5

1 Answers1

2

When the UAC slider is all the way down, programs that ask for elevation will automatically be approved. That's distinct from all programs being elevated all the time (which is effectively what you get if you completely disable UAC, which would break things).

Programs can specify their elevation behavior in their manifest. Most programs run asInvoker, at the same level as the calling process. Some, like the Registry Editor and MMC, ask to be run with the highestAvailable permissions, so with UAC on, admins would get an elevation prompt but normal users wouldn't. Others, like most setup programs, are completely useless without elevation and therefore requireAdministrator. That's why setup programs are automatically elevating for you. Evidently, pip is not manifested as requiring elevation. "You have not because you ask not."

Bonus demonstration: one way to start an elevated program from the command line is PowerShell's Start-Process with -Verb runas, like this:

Start-Process cmd -Verb runas

With UAC on, running that will give you an elevation prompt for the command prompt. With UAC lowered to the minimum allowed by the UI, you get an elevated command prompt with no UAC dialog. (You can see the difference in the command window's title bar.) Had the -Verb runas been left off, you would have just got a normal command prompt.

Community
  • 1
Ben N
  • 42,308