What if Windows allowed programs to install, without requiring Admin access?

[VirtualLarry]

Just thinking about this. So many programs (all of them?) require Admin access in their installer. Is this just because the programs install into Program Files, for all users?

What if programs could (should?) install into your user profile, instead, and were only installed for that user? (I believe that Chrome can do this, somehow.)

I was just thinking of ways to mitigate the huge wave of "PUPs" / "CompanionWare", stuff that gets install into a Windows OS at the OS level, that is bundled with other software. (Conduit, and friends, etc.)

If programs would install just as a user, and therefore be denied access to install into the entire OS, problems like that could largely be contained.

 

[postmortemIA]

Well you can't blame Windows directly, afterall many programs do offer you a choice of installation directory. It is up to installer trying to write program files to directories accessible to every user ... so far that have been directories that need admin privileges in order to write to them.
However, Microsoft is to blame for not having stronger concept of "user apps".

 

[KB]

It is possible for users to install aps that only write to their profile. The big problem is that most apps need to write to the registry which requires admin access. If MS created a user only registry, then it may work.

 

[Rhonda the Sly]

Apps can write to CURRENTUSER without admin rights, I believe. All said, a program that installs without admin rights might still require elevated rights for various tasks while running. Process Explorer, as an example, is fully portable but won't do everything as a local user.

 

[cubby1223]

Just thinking about this. So many programs (all of them?) require Admin access in their installer. Is this just because the programs install into Program Files, for all users?

What if programs could (should?) install into your user profile, instead, and were only installed for that user? (I believe that Chrome can do this, somehow.)

I was just thinking of ways to mitigate the huge wave of "PUPs" / "CompanionWare", stuff that gets install into a Windows OS at the OS level, that is bundled with other software. (Conduit, and friends, etc.)

If programs would install just as a user, and therefore be denied access to install into the entire OS, problems like that could largely be contained.

Anti-virus software need to figure out how to get around the legal restrictions placed on them, and actually detect conduit and remove it. Why can't they just bundle an anti-malware component along with it?

 

[BrightCandle]

Very few apps have really adopted the new split between user and admin. Its certainly possible to have apps installed for the user and not requiring admin, both in terms of registry access and file system access. Indeed much of what chrome does is in the user space as it installs into app data. But its an exceptional case because most apps are still using the pre vista assumption of admin for the install directory.

 

[imagoon]

I can think of several that can install in the profile just fine. The issue is the app developer and not Windows at least.

Random list top of my head:
Chrome
Firefox
World of Warcraft
Diablo 3
Spotify
Filezilla
7zip (installed as single user)
PuTTY

 

[imagoon]

It is possible for users to install aps that only write to their profile. The big problem is that most apps need to write to the registry which requires admin access. If MS created a user only registry, then it may work.

They did:

HKEY_CURRENT_USER

It is fully read/write for the local user and stored in the user profile.

 

[KB]

They did:

HKEY_CURRENT_USER

It is fully read/write for the local user and stored in the user profile.

You are right, this is the user-specific registry. They still need to implement a user version of HKEY_CLASSES_ROOT and HKEY_LOCAL_MACHINE for it to work since so many installers must write to these locations.

 

[imagoon]

You are right, this is the user-specific registry. They still need to implement a user version of HKEY_CLASSES_ROOT and HKEY_LOCAL_MACHINE for it to work since so many installers must write to these locations.

They do. They are subkeys of HKEY_CURRENT_USER and use redirection.

Quite simply, no one without admin rights should be able to write to HKEY_CLASSES_ROOT and HKEY_LOCAL_MACHINE. These are system wide hives and it makes sense to require admin rights to write to them. If the apps would properly install as a user install, the HKCR and HKLM in HKCU would work fine for that users session.