Enable Non-Admins to Modify ClearType & Color Calibrate in Win7

When doing colour calibration or ClearType Text Tuning in Windows 7 a standard user can happily click through the wizards until the very end…when clicking Finish…

Although ClearType is enabled in Windows 7 maybe there are people who like jagged edged fonts and want to disable it. If they’re not admin, they can’t.

image

Boom! UAC Prompt…

image

The important point here is the CLSID … let’s grab that and search the registry under HKCR\CLSID

This brings us to

image

Importantly there is the Elevation key

image

Let’s set it to 0. I don’t even have access as Local Admin, I have to right click Properties and give myself permission (You may need to take ownership of key). This registry key typically can only be modified by TrustedInstaller. You should take this as sign that this is not something you should be modifying.

Warning! I do not recommend changing these Elevation/Enabled registry key settings. I am doing this for experimentation. You should backup the key before changing, you can break components of Windows modifying these keys. In addition to potentially introducing security vulnerability this solution may also be broken by Windows Updates in the future.

image

OK I can now happily set Enabled to 0

The UAC Shield icon is now gone from ClearType Tuner and no errors thrown when applying settings

image

Using ProcMon I found it also tries to update Registry Keys under HKLM\SOFTWARE\Microsoft\Avalon.Graphics so you may need to give Users full control here too.

For Display Calibration it is different here we see DCCW.exe is involved…

image

In this case the executable knows to elevate because it has a manifest. This could be in format <programname>.exe.manifest or it can be embedded as a resource. To view the embedded resource I use ResEdit (http://www.resedit.net/) Use 64-bit version for 64-bit EXEs and 32-bit version for 32-bit EXEs.

image

To override this I created a SHIM using Application Compatibility Toolkit (ACT)(http://www.microsoft.com/download/en/details.aspx?id=7352) to apply runAsInvoker to the application. Because in this case I’m updating this for a 64-bit executable I need to ensure I’m using 64-bit version of Compatibility Administrator. If you’re not familiar with manifests please refer to Microsoft’s UAC Manifest documentation http://technet.microsoft.com/en-us/query/bb756929

For specific details on how to create SHIMs refer to ACT’s documentation.

image

After saving and installing my SHIM….Great. Now no UAC prompt, but Access Denied:

image

So I used one of my all-time favourite ProcMon (http://live.sysinternals.com/ProcMon.exe) filters – Result is ACCESS DENIED. I also could have used ACT’s Standard User Analyser + Application Verifier for a more automated report.

image

We see a single ACCESS DENIED event

image

So I granted Users full control to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM

This got me much further in program, and no further errors in program. But I also found Access Denied here

image

I then gave Users full control over these keys and all sub keys:

Imaging Devices Control Class –

HKLM\SYSTEM\CurrentControlSet\Control\Class\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}

Monitors Control Class –

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}

Now colour calibration works fine, I tested changing settings and they applied fine.

image

So if you need to do this, understand this is an unsupported hack to allow standard users to run these tools. If you do use this I would re-test post any operating system updates.

I don’t know the security implications of allowing standard users to run these tools, although I believe the reason to require administrator is because the settings affects all users on a system, not just a single user. 

About chentiangemalc

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in Application Compatibility, ProcMon, Windows 7 and tagged . Bookmark the permalink.

3 Responses to Enable Non-Admins to Modify ClearType & Color Calibrate in Win7

  1. xpclient says:

    Just install the ClearType Tuner PowerToy which runs without UAC and allows more granular control. :)

  2. Lasse says:

    And Microsoft also advises not to change the elevation keys :-)
    BTW: I have found out that you can work around this issue just by editing the necessary registry keys once:
    [HKEY_CURRENT_USER\Control Panel\Desktop] “FontSmoothingType”=dword:00000001
    [HKEY_CURRENT_USER\Control Panel\Desktop] “FontSmoothing”=”1”

    After login off and on again you will be able to switch ClearType on and off WITHOUT admin priviliges (though it pops up again) …

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s