When doing colour calibration or ClearType Text Tuning in Windows 7 a standard user can happily click through the wizards until the very end…when clicking Finish…
Although ClearType is enabled in Windows 7 maybe there are people who like jagged edged fonts and want to disable it. If they’re not admin, they can’t.
Boom! UAC Prompt…
The important point here is the CLSID … let’s grab that and search the registry under HKCR\CLSID
This brings us to
Importantly there is the Elevation key
Let’s set it to 0. I don’t even have access as Local Admin, I have to right click Properties and give myself permission (You may need to take ownership of key). This registry key typically can only be modified by TrustedInstaller. You should take this as sign that this is not something you should be modifying.
Warning! I do not recommend changing these Elevation/Enabled registry key settings. I am doing this for experimentation. You should backup the key before changing, you can break components of Windows modifying these keys. In addition to potentially introducing security vulnerability this solution may also be broken by Windows Updates in the future.
OK I can now happily set Enabled to 0
The UAC Shield icon is now gone from ClearType Tuner and no errors thrown when applying settings
Using ProcMon I found it also tries to update Registry Keys under HKLM\SOFTWARE\Microsoft\Avalon.Graphics so you may need to give Users full control here too.
For Display Calibration it is different here we see DCCW.exe is involved…
In this case the executable knows to elevate because it has a manifest. This could be in format <programname>.exe.manifest or it can be embedded as a resource. To view the embedded resource I use ResEdit (http://www.resedit.net/) Use 64-bit version for 64-bit EXEs and 32-bit version for 32-bit EXEs.
To override this I created a SHIM using Application Compatibility Toolkit (ACT)(http://www.microsoft.com/download/en/details.aspx?id=7352) to apply runAsInvoker to the application. Because in this case I’m updating this for a 64-bit executable I need to ensure I’m using 64-bit version of Compatibility Administrator. If you’re not familiar with manifests please refer to Microsoft’s UAC Manifest documentation http://technet.microsoft.com/en-us/query/bb756929
For specific details on how to create SHIMs refer to ACT’s documentation.
After saving and installing my SHIM….Great. Now no UAC prompt, but Access Denied:
So I used one of my all-time favourite ProcMon (http://live.sysinternals.com/ProcMon.exe) filters – Result is ACCESS DENIED. I also could have used ACT’s Standard User Analyser + Application Verifier for a more automated report.
We see a single ACCESS DENIED event
So I granted Users full control to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM
This got me much further in program, and no further errors in program. But I also found Access Denied here
I then gave Users full control over these keys and all sub keys:
Imaging Devices Control Class –
Monitors Control Class –
Now colour calibration works fine, I tested changing settings and they applied fine.
So if you need to do this, understand this is an unsupported hack to allow standard users to run these tools. If you do use this I would re-test post any operating system updates.
I don’t know the security implications of allowing standard users to run these tools, although I believe the reason to require administrator is because the settings affects all users on a system, not just a single user.