Microsoft .NET Framework, .NET Application requires Local Administrator Rights

Hi,

We have an inhouse developed VB.NET Windows application which runs
successfully only when the user is given a local administrator rights.
Without which, it fails to start. There isn't anything reported on the
event viewer. Giving the user full access to C:\ drive also doesn't do
the trick. Unfortunately, we do not have the code of this application
and hence cannot view what the application is trying to access. Note
that we have both .NET 1.1 and 2.0 running on the machine but the
app.config file has been configured to point to ver. 1.1 runtime.

We need to run the application without giving user local administor
rights. Can anyone suggest what might be the cause of this problem and
approach of troubleshooting it?

Thanks in advance
ec.

Perhaps trying to access some protected area of the registry or file
system... possibly something event-log related, possibly trying to
open a port that hasn't previously been opened by an administrator

My advice: download Lutz Roeder's .NET Reflector, and look at the
code. I'd hazard a guess that it isn't obfuscated, so you should be
able to see what is going on.

Marc

Thanks for your reply.

I took a look through the Reflector but can't seems to figure out
anything.

Does anyone know if there is there any tool out there that allows me
to monitor what resources (files/registry/ports) the main application
is trying to open/access?

As I am not a programming guru, can anyone also guide me into
performing somekind of debug print when the error is thrown?

ec.

http://www.microsoft.com/technet/sysinternals/default.mspx

Active Ports and CurrPort are free.

Try
code
Catch Exception ex
debug.Print(ex.Message)

end Try

Windbg and associated programs are your friend in these cases! Whilst not a
5 second thing, it's not as scary as it first seems. There are lots of demo
and help guides out there:

http://en.wikipedia.org/wiki/WinDbg
http://www.codeproject.com/debug/windbg_part1.asp

With a few commands you can usually find if an exception is being thrown
(and hidden by code), etc.

- Paul.

Try giving FullTrust Permision Set to Machine-"Code-
Groups"-"AllCode"-"Edit Code Group Properties" for Runtime Security
Policy using 1.1 or 2.0 configuration tool.

If this works then reduce the Permission set to one level below the
previous one till you reach the correct Permission Set which allows
you applicaiton to run. Try to reach the optimised Permission Set
setting which doesn't compromise security. Don't forget to remove the
user from Local admin before trying this out.

Thanks pb but unfortunately this doesn't work...

Paul,

I downloaded Windbg and tried out a couple of things, but couldn't
seem to be able to track the exception that has been thrown. As I am
not a programmer myself, would you be able to give me a few pointers
to start with?

Thank you so much.

Sorry,

Sorry I can't be more help, I've not had to do this myself either - I just
saw it in a DevWeek session earlier this year - so know it is possible.
Maybe some one else in the newsgroup could be of assistance. Maybe start a
new thread asking for assistance on using WinDbg to trap a "an unexpected
silent program exit" that could occur in either managed or un-managed code.

Looking through the notes I took, as always, they mean absolutely nothing
now - and I don't have windbg, etc set up on this PC. I just know that you
can get everything you should need through windbg - you can get more info
using some of the managed extensions for that tool (SOS I think it's
called). The one helpful link I can find is a reference to this book which
the presenter recommended:

http://www.microsoft.com/mspress/books/8650.aspx

I do remember that in the demo we saw how to catch the following exception,
which would never be caught be the expected error trapping in FuncA()
because FuncB() hides it.

- Paul.

FuncA()
{
try
{
FuncB();
}
catch(Exception ex)
{
Console.WriteLine(ex.Message);
}
}

FuncB()
{
try
{
// Open some file that you don't have any access to
}
catch
{
// Don't do anything, but we've just hidden the exception from the
calling function
}
}

If you are still having the rpblem then can you pl. upload the error
message shown when the user is not a local admin.

Hi Pb, The exact message as follow:

==================================================
HEADER:
Application.exe - Common Language Runtime Debugging Services
DETAILS:
Application has generated and exception that could not be handled.
Process id=0x12d8(4824), Thread id=0x13b4(5044)

Click OK to terminate the application.
Click CANCEL to debug the application.
==================================================

Thanks you so much.

Sorry for replying late as I was kind of busy during the week end.
Anyways if you are still facing this problem then please also let me
following things to get to root cause of the problem and if you stll
want to reslove it.

Are you running 64 bit OS?
Then use this link http://www.dotnet247.com/247reference/a.aspx?u=http ://support.microsoft.com/?id=283150
to register this application to use Dr Watson as a stack trace. The
run the application and it will generate the stack tract in windows
\system32 wit name drwatson or something like that. Post the content
of this file to check where exactly it is failing.

Pb, Thanks for taking the time to work this out with me. I really
appreciate your enthusiasm.

However, I am not running a 64-bit OS. Its Windows Server 2003 SP2.
Note that I have both .NET 1.1 and 2.0 framework installed on this
machine.

Thanks again.

i all,

I did a dbgview on against the application using an administrator and
non-administrator account. Seems like there's something happening with
gdiplus.dll. However, the exception was not handled during
administrative access, which is why it went through.

Can anyone please direct me towards some troubleshooting steps? Thank
you very much.

Below are the logs.

=================================================================================
Administrator Access
=================================================================================
Microsoft (R) Windows Debugger Version 6.7.0005.0
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: "C:\Program Files\Pentafin\OneVue\OneVue.exe"
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search
path. *
* Use .symfix to have the debugger choose a symbol
path. *
* After setting your symbol path, use .reload to refresh symbol
locations. *
****************************************************************************
Executable search path is:
ModLoad: 11000000 11080000 OneVue.exe
ModLoad: 7c800000 7c8c0000 ntdll.dll
ModLoad: 79000000 79045000 C:\WINDOWS\system32\mscoree.dll
ModLoad: 77e40000 77f42000 C:\WINDOWS\system32\KERNEL32.dll
(18e0.18e4): Break instruction exception - code 80000003 (first
chance)
eax=78000000 ebx=7ffd5000 ecx=00000007 edx=00000080 esi=7c8877f4
edi=00141f38
eip=7c81a3e1 esp=0012fb70 ebp=0012fcb4 iopl=0 nv up ei pl nz
na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ntdll.dll -
ntdll!DbgBreakPoint:
7c81a3e1 cc int 3
0:000> g
ModLoad: 71c20000 71c32000 C:\WINDOWS\system32\tsappcmp.dll
ModLoad: 77ba0000 77bfa000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77f50000 77feb000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77c50000 77cef000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 76f50000 76f63000 C:\WINDOWS\system32\Secur32.dll
ModLoad: 77da0000 77df2000 C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 77c00000 77c48000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 77380000 77411000 C:\WINDOWS\system32\USER32.dll
ModLoad: 662d0000 662f8000 C:\Program Files\Citrix
\system32\mfaphook.dll
ModLoad: 679b0000 67a0d000 C:\Program Files\Citrix
\system32\CtxSbxHook.DLL
ModLoad: 65a90000 65a98000 C:\Program Files\Citrix
\system32\mmhook.dll
ModLoad: 7c340000 7c396000 C:\WINDOWS\system32\MSVCR71.dll
ModLoad: 651c0000 651c9000 C:\Program Files\Citrix
\system32\tzhook.dll
ModLoad: 656f0000 65709000 C:\Program Files\Citrix
\system32\scardhook.dll
ModLoad: 65200000 652e4000 C:\Program Files\Citrix
\system32\twnhook.dll
ModLoad: 67750000 67757000 C:\Program Files\Citrix
\System32\cxinjime.dll
ModLoad: 650f0000 650f7000 C:\Program Files\Citrix
\system32\wdmaudhook.dll
ModLoad: 791b0000 79418000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\mscorwks.dll
ModLoad: 00950000 00995000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\fusion.dll
ModLoad: 77670000 777a9000 C:\WINDOWS\system32\ole32.dll
ModLoad: 7c8d0000 7d0ce000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77420000 77523000 C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.Common-
Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55\comctl32.dll
M

n 6 Jun, 06:44, ECEE < XXXX@XXXXX.COM > wrote:
> Microsoft (R) Windows Debugger Version 6.7.0005.0> > Copyright (c) Microsoft Corporation. All rights reserved.> >> > CommandLine: "C:\Program Files\Pentafin\OneVue\OneVue.exe"> > Symbol search path is: *** Invalid ***> > ***************************************************************************gt;
> * Symbol loading may be unreliable without a symbol searc>
> path. >
> * Use .symfix to have the debugger choose a symbo>
> path. >
> * After setting your symbol path, use .reload to refresh symbo>
> locations. >
> ***************************************************************************>*
> Executable search path i>:
> ModLoad: 11000000 11080000 OneVue.e>e
> ModLoad: 7c800000 7c8c0000 ntdll.d>l
> ModLoad: 79000000 79045000 C:\WINDOWS\system32\mscoree.d>l
> ModLoad: 77e40000 77f42000 C:\WINDOWS\system32\KERNEL32.d>l
> (18e0.18e4): Break instruction exception - code 80000003 (fir>t
> chanc>)
> eax=78000000 ebx=7ffd5000 ecx=00000007 edx=00000080 esi=7c8877>4
> edi=00141f>8
> eip=7c81a3e1 esp=0012fb70 ebp=0012fcb4 iopl=0 nv up ei pl >z
> na po >c
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=00>0
> efl=000002>2
> *** ERROR: Symbol file could not be found. Defaulted to expo>t
> symbols for ntdll.dll>-
> ntdll!DbgBreakPoin>:
> 7c81a3e1 cc int >3
> 0>000>>g
> ModLoad: 71c20000 71c32000 C:\WINDOWS\system32\tsappcmp.d>l
> ModLoad: 77ba0000 77bfa000 C:\WINDOWS\system32\msvcrt.d>l
> ModLoad: 77f50000 77feb000 C:\WINDOWS\system32\ADVAPI32.d>l
> ModLoad: 77c50000 77cef000 C:\WINDOWS\system32\RPCRT4.d>l
> ModLoad: 76f50000 76f63000 C:\WINDOWS\system32\Secur32.d>l
> ModLoad: 77da0000 77df2000 C:\WINDOWS\system32\SHLWAPI.d>l
> ModLoad: 77c00000 77c48000 C:\WINDOWS\system32\GDI32.d>l
> ModLoad: 77380000 77411000 C:\WINDOWS\system32\USER32.d>l
> ModLoad: 662d0000 662f8000 C:\Program Files\Citr>x
> \system32\mfaphook.d>l
> ModLoad: 679b0000 67a0d000 C:\Program Files\Citr>x
> \system32\CtxSbxHook.D>L
> ModLoad: 65a90000 65a98000 C:\Program Files\Citr>x
> \system32\mmhook.d>l
> ModLoad: 7c340000 7c396000 C:\WINDOWS\system32\MSVCR71.d>l
> ModLoad: 651c0000 651c9000 C:\Program Files\Citr>x
> \system32\tzhook.d>l
> ModLoad: 656f0000 65709000 C:\Program Files\Citr>x
> \system32\scardhook.d>l
> ModLoad: 65200000 652e4000 C:\Program Files\Citr>x
> \system32\twnhook.d>l
> ModLoad: 67750000 67757000 C:\Program Files\Citr>x
> \System32\cxinjime.d>l
> ModLoad: 650f0000 650f7000 C:\Program Files\Citr>x
> \system32\wdmaudhook.d>l
> ModLoad: 791b0000 79418000 C:\WINDOWS\Microsoft.NET\Framewo>k
> \v1.1.4322\mscorwks.d>l
> ModLoad: 00950000 00995000 C:\WINDOWS\Microsoft.NET\Framewo>k
> \v1.1.4322\fusion.d>l
> ModLoad: 77670000 777a9000 C:\WINDOWS\system32\ole32.d>l
> ModLoad: 7c8d0000 7d0ce000 C:\WINDOWS\system32\SHELL32.d>l
> ModLoad: 77420000 77523000 C:\WINDOWS\WinS>S
> \x86_Microsoft.Windows.Commo>-
> Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55\comctl32.d>l
> ModLoad: 79780000 7998e000 c:\windows\microsoft.net\framewo>k
> \v1.1.4322\mscorlib.d>l
> ModLoad: 79990000 79cce000 c:\windows\assemb>y
> \nativeimages1_v1.1.4322\mscorl>