Administrator privileges and limited privileges, different instances of the same app?

[pingu-the-penguin]

I didn't open this as an issue as I assume it is the fundamental way Windows handles this but i thought I should bring it up in case there are any improvements to be made.

My setup:

Standard Windows account for everyday usage.
Admin Windows account with administrative privileges, rarely used if at all.

I noticed that when I open the HSS app, I am obviously prompted to elevate to Admin as that is the setting I have chosen. Once I authenticate, I have my normal everyday instance of the HSS app ready with my app-specific settings configured. One downside is that the default directory for example points to the Downloads folder in the Admin account rather than in my standard account. Another downside i noticed is that when setting up a Sandbox for the Sandbox maker, the file is also saved in the Admin user's files rather than my standard's user. The RPC service for WinGet management also fails to connect when I am authenticated with Admin while being on Standard.

I also sometimes get messages saying Access is denied, but I don't remember the circumstances where that would happen.

However, if I choose to cancel the elevation operation then I am launched into the standard instance which is basically as if I installed a different instance of the app that doesn't save my configured settings or any of my sandboxes, etc. This is likely because this instance is running from the standard user and all the directories are based on the standard user. The WinGet management RPC service connects normally in this instance even though all that changed was whether I authenticated with admin privileges or not.

I noticed that Sandbox maker also doesn't allow certain configurations if I am not elevated, like allowing network connections through Windows Sandbox. The sandbox instance would not have network connection unless i created it and launched it while elevated.

I think that the creation of seperate instances with some features working while authenticated and others not creates a confusing user experience. I am not sure whether this is a design decision or how Windows fundamentally handles elevation but I am sure there could be a better way to handle this.

Kind Regards,
Pingu

[pingu-the-penguin]

I noticed this also affects the Manage Installed Apps page which requires elevation to open. However if you elevate on the standard user, you are met with the apps installed in the Admin user rather than your local user.

A workaround I noticed is that I can still open the WinGet Management Page and seemingly manage apps from there.

Although this seems to be duplicated functionality between manage installed apps and WinGet.

I'm a fan of the WinGet management page for managing installed apps as I noticed that not all apps I have installed are present under "Manage Installed apps", haven't checked if the opposite is true.

[HotCakeX]

Just wanted to let you know that even if i don't immediately respond, i see the posts and appreciate them, please keep them coming whenever you notice anything, i'll get to review and provide an actual comment next week because i'll be away and only remotely available till then. Thank you ^^

[pingu-the-penguin]

No worries, take your time! I don't expect immediate responses regardless, we all have things going on!

[HotCakeX]

Hi,
About the Downloads folder, it is detected automatically for the user account that is currently running the app, but you have the option to choose any other custom location, and it will be saved in the settings. The app can't guess/know which other user account's downloads folder the user prefers, in case there are more than 1, so it's only up to the user to choose that.

You're also able to backup and restore app settings; since you mentioned you have 2 accounts, you can backup/export your settings from one account and then import them in the app after you launch it as another account. All changes are instantly applied to the app when you restore settings.

App settings you configure and export remain usable between app versions, so you can use the same app setting that you export today for all future app versions too.

Windows apps are all user-scoped, so you can install the app once and then each user will have its own configurations, separate from all other users, that cannot be changed by me.

Windows Sandbox limitations you mentioned are in place by Microsoft. The Harden System Security app offers all of the options to create a customized Sandbox, but Windows ultimately decides whether to honor them or not based on your user account's privilege level.

I'll add the option so user can change the location where Windows Sandbox files and configurations are saved to.

Winget and the Installed Apps pages offer similar features but under the hood they operate on completely different stacks. The Manage Installed Apps is only for packaged apps and offers specific features to manage them. WinGet Management page is based on the WinGet engine's features. It does offer some management capabilities for packaged apps too but they are more generalized because they also apply to portable apps, non-packaged apps, legacy programs and so on.

I'll look into that RPC error you mentioned for WinGet and try to reproduce it. Thanks!

[HotCakeX]

Couldn't reproduce the RPC error. Do you mind trying to reproduce it again with the latest version of the app and tell me the steps i need to take? ty!

[HotCakeX]

As promised, here is the update that adds the ability to change Sandbox save folder so you can choose another folder that you like: https://github.com/HotCakeX/Harden-Windows-Security/releases/tag/HardenSystemSecurity-v1.0.74.0

In order to improve the multi-user experience, especially when they have different privileges, i've pushed a change to make the backup & restore page which is accessible from the settings page, to be available when running unelevated. It's not yet in the app but it will be included in the next update.