Inno Setup ShellExec privileges

Question

I have an InnoSetup project that launches an application when it's done with ShellExec. The issue is my installer escalates when it launches, but I want my launched application to run non escalated. Is this possible some way?

procedure LaunchApplication(shortcut: String);
var
  ErrorCode: Integer;
begin
  ShellExec('', ExpandConstant('{userprograms}\' + shortcut),'', '', SW_SHOW, ewNoWait, ErrorCode);
end;

Answer 1

Here I assume you are using

[Setup]
PrivilegesRequired=admin

to elevate the installer (UAC)

To run any program in non-elevated mode use ExecAsOriginalUser function:

Prototype:

function ExecAsOriginalUser(const Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ResultCode: Integer): Boolean; Description:

Executes the specified executable or batch file, using the (normally non-elevated) credentials of the user that started Setup initially. See Exec and the [Run] section flag runasoriginaluser for more information. Remarks:

This function is not supported at uninstall time.

In very unusual failure cases (e.g. if the initial Setup process died unexpectedly), it is possible for this function to raise an exception instead of just returning False.

Answer 2

If you use a [Run] entry with the postinstall flag (so that a checkbox appears on the Finished page), then running non-elevated is the default behaviour. (You can also set this for non-postinstall entries by using the runasoriginaluser flag.)

Note however that both this and the ExecAsOriginalUser function etc do not guarantee that they run non-elevated -- if the installer is originally run from an elevated context (eg. elevated command prompt, another elevated installer, or user right click Run As Administrator) then the "original user" is also the elevated user. But in these cases you can assume the user is getting what they asked for.