How to find out what permission an application needs under Windows 7

Question

Is there a way to find out what privileges my application needs in order to run in a Windows 7 environment?

I have a Delphi application that is using BDE and ODBC for database connectivity. This application works on most computers with Windows 7 running on a normal user account. However on some computers it only works on accounts with administrative privileges and is not working correctly on normal user accounts. I suspect it's a permission problem. The computers also are running in Active Directory.

I tried to find some informations using Process Monitor from SysInternals, however the output for me is too advanced. The process monitor log for two runs of my app (1. successful with administrative rights, 2. unsuccessfull on normal rights) had over 22k lines and i could not find the answer (needle) in the process monitor log (haystack).

What could i do to determine the privileges that my app needs in windows 7?

Answer 1

Use the Standard User Analyzer from the Microsoft Application Compatibility Toolkit.

The Standard User Analyzer (SUA) tool and the Standard User Analyzer Wizard (SUA Wizard) both enable you to test your applications and to monitor API calls in order to detect potential compatibility issues due to the User Account Control (UAC) feature in the Windows® 7 operating system.

UAC, formerly known as Limited User Account (LUA), requires that all users (including members of the Administrator group) run as Standard Users, until the application is deliberately elevated, by using the security prompt dialog box. However, not all applications can run properly with the Standard User role, due to the application requiring access and privileges for locations that are unavailable to a Standard User.

Answer 2

Aaron Margosis has a tool called LUA Buglight that is designed to help track down issues related to privileges.

You can download the latest version from this blog post: LUA Buglight 2.1.1 with support for Win7/2008R2 SP1

It is similar in concept to the MS Application Verifier. However, in practice I found LUA Buglight much easier to use and understand. Same with ProcessMonitor. It will monitor your process in a similar way but only report actions that failed as a normal user but succeeded as a admin user.

There is no documentation but it is simple to use. From the main GUI window select your Exe and let the BugLight program launch it. You need to be running in an Admin account with UAC enabled. Run your program though the steps that fail when you are not an admin. When you are done click on the Stop Logging button to see a report that lists what calls would have failed without admin rights.