?

Log in

No account? Create an account

Previous Web | Next Web

Note: The information in this entry describes a change to the Windows' Registy. If you would like to apply this change, but you do not understand what the Registry is, what it does, what manually editing the Registry could mean for your computer or what the modification described is doing, YOU SHOULD NOT MAKE THE CHANGE(S) DESCRIBED. If you proceed and Something Bad™ happens to you or your computer, sorry, but that's your problem!

A couple of days ago, I decide to update a bunch of open-source software that I have installed on Windows 7. This is (obviously) not a world-altering event, I only mention it as its what triggered this little tweak.

One of the programs I updated is the ViM editor, using the GViM 7.4 installer.

I then found myself needing to use ViM's 'DIFF' mode and ran into the issue described in this post on Stack Overflow.

In attempting to apply the described fix, I ran into something that's annoyed me every time I've run into it, but always when I've been trying to just get something done... and that is that although I can right-click a file in Explorer and choose "Edit with ViM", the GViM that gets started will not be able to save the file if its in a location controlled by UAC.... in this particular case, c:\Program Files (x86)\vim... and if your editor doesn't provide its own privilege elevation support, well, you're stuck!

Now normally I'll just 'Command Prompt Here' and use either Kai Liu's elevate.exeor (more likely) ConEmu's csudo.cmd to run console-mode ViM on the file with elevated priveleges.

But this time I decided to do something about it... I had a quick Google for "windows edit as administrator" which returns at the top a few items suggesting using a different editor, like Notepad++ or running a one-off elevated Notepad by right-clicking a shortcut and choosing 'Run as administrator,' and using that to open the file... but these are just, to be frank, craptastic none-solutions... I want to be able to edit a file from anywhere in Explorer in the editor of my choice without having to copy the path and open a file manually in an editor I've had to manually invoke with elevated privileges.... after a few pages of this, I couldn't be bothered any more and gave up on Google and the wisdom of the masses, as it had occurred to me that I already know how to do 'runas' stuff for Explorer, atleast in part, so what if I used what I know to add an 'Edit with Administrative GViM'-type entry to all file types in Explorer and have it trigger UAC appropriately???

So I did... I even made it show the little UAC shield, just to be friendly! And it shows up when there's a 'runas' (iow, 'Run As Administrator") entry (rather than masking or being masked by it), such as with a batchfile... And to top it off, it only shows up if you right-click with Shift held down!

Screengrab: No entry with normal right-click:

[Explorer context-menu]

Screengrab: Shift-right-click shows the new Administrative ViM entry, with the UAC shield:

[Explorer extended context-menu]

(I used an .exe for this image just to show that the entry shows up, even when a 'runas' entry is present, because until 5 seconds ago, I'd forgotten that it was .bat files that had first shown the masking problem and I can't be bothered redoing the screengrabs!)

And what Dark Magic is needed to make this work?

Well, two things are needed:

  • Nir Sofer's awesome little NirCmd utility (download links are at the bottom of the page for 32- and 64-bit versions)
  • and a tiny little .reg file (described below)

Can't we do this only using windows?

Well... possibly... Windows does have a runas command, so you might just be able use that and follow the same principles I'm using however, runas is a Command Prompt tool and does not display the UAC prompt window (atleast, I can't get it to anyway), it asks for a password in an NT-DOS box.

Now, you might be thinking, as I did, Well surely Microsoft thought of this? Isn't there a way to do this straight from the Registry? I mean, that's how the "Run As Administrator" context-menu item works....

Believe me, I've asked myself the same questions.... and when I started out with this, I was using runas to just start GViM and I thought yay! that works and its so easy! and started writing this blog post...

Then I tried to admin-edit a batchfile using my menu item... except my menu item was AWOL....

And here's the Microsoft kick-in-the-crotch.... You can only have one runas item!

I thought I remembered a bit of Windows Voodoo, which was that you could have more than one runas item; you just used runas2 for the 2nd one... but that definitely doesn't work on Windows 7.

Thats why I've ended up using NirCmd; I'm hacking around the absence of something I expected the Windows Shell to implement, and cannot for the life of me work out why it doesn't... I mean, runas2, etc may not be pretty, but it would have been idiotically easy to have implemented!

NirCmd

NirCmd is a very handy 'Swiss Army Knife'-type utility. It has loads of neat little things it can do, for example, it can turn your monitor off, ask a question using a Windows dialog box and invoke a command if you answer in the affirmative, create shortcuts, minimise windows and all sorts of other useful little things.

In this particular case, we're going to use the elevate functionality, which lets you run a program with elevated privileges.

Download and extract NirCmd somewhere you can find it... c:\windows or c:\Program Files is fine... I'm using c:\Program Files as my example location.


Nir Sofer has all sorts of other nifty utilities too, listed on NirSoft.net, and they can (almost) all be downloaded (including x64 versions where available), packaged with a handy launcher utility (say for a USB stick) from launcher.nirsoft.net/download.html.

Note: I don't have any association with Nir or these tools, I've just had them as part of my software toolbox for years and just think they're really cool and everyone should know about them...!


Why are you using this privilege-elevation tool?

Can't you use one of the ones mentioned earlier?

Well, unlike those other ones, which are designed for use in a Command Prompt, this one doesn't bring/flash up an (annoying) NT-DOS window when you invoke it from the 'Run...' dialog or (more importantly) from a context-menu entry.

Registry Modification

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\*\shell\runas_gvim]
@="Ed&it with Vim as Administrator"
"HasLUAShield"=""
"Extended"=""

[HKEY_CLASSES_ROOT\*\shell\runas_gvim\command]
@="\"c:\\program files\\nircmd.exe\" elevate 
                      \"c:\\program files (x86)\\vim\\vim74\\gvim.exe\" \"%1\""

Note: The last line starts with @ and goes right the way through to the %1 bit (as shown in the image below); its just too wide for my journal layout, so I had to split it.

Screengrabs: The ruans_gvim registry hierarchy in regedit:

[Registry Key: HKCR\*\shell\runas_gvim]

[Registry Key: HKCR\*\shell\runas_gvim\command]

You can change various things (the bits marked in bold in the .reg file):

  • The registry key your menu entry will use
    • Modify runas_gvim everywhere it occurs.
      • By using different keys (runas_gvim, runas_notepad, etc), you can create as many Administrative tasks as you like.
      • I've used "runas" as part of my key names so that the elevated commands stand out when I'm looking in the registry, but that's just my preference, which you can ignore.
      • But don't use the "runas" key
  • The text that will show in the context-menu for you entry
    • Modify the value of runas_gvim\@
      • The & marks the next character in the text string as the hotkey for the entry (in this case it's 'i').
      • You do not have to have an & in you menu text.
  • The location of the nircmd.exe program
    • Modify the C:\\program files that precedes nircmd.exe
  • The command for the program you want
    • Modifying the portion of the runas_gvim\command\@= value that comes after elevate.
    • For the command string, remember that in a .reg file, you need to double-up on your backslashes
    • The \"%1\"" lump needs to appear as-is as the last thing on the line
  • Whether your entry is only shown when shift-right-click is used
    • the "Extended"="" line
    • If you want your entry to always show in the context-menu, you can
      • remove this line from the .reg file before you apply it
      • or you can delete the value-pair in regedit if you've already applied it
  • Whether your entry shows the UAC shield icon in the context-menu
    • the "HasLUAShield"="" line
    • If you don't want the UAC Shield icon shown
      • remove this line from the .reg file before you apply it
      • or you can delete the value-pair in regedit if you've already applied it

Uninstalling

Removing your menu entry is really easy; you can either use regedit to navigate to HKEY_CLASSES_ROOT\*\shell and delete the runas_gvim (or whatever you used) key, or you can update (if you changed the registry key) and use this .reg file:

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\*\shell\runas_gvim]

And if you've deleted all of your Administrative entries, and aren't using NirCmd for anything else, you can delete that too.

Note: This is only tested in Windows 7, but it should work in any Windows that uses User Account Control (UAC).