| Best Practice: Use GPO to Disable PCA and UAC Virtualization for Testing Software Developed for Windows 7 |
|
|
| General |
| Written by Darwin Sanoy |
| Wednesday, September 7, 2011 5:23pm |
|
For software developers on Windows 7, Program Compatibility Assistant (PCA) and UAC Virtualization may mask application problems that should be fixed in the source code. IT professionals supporting software developers should consider disabling these settings for computers and user ids that are used to test software. An important note right up front: There is a dedicated policy to Disable ONLY UAC Virtualization - disabling all of UAC affects many other aspects of Windows security - this article is not advocating complete disablement of UAC.The topics in this article are taught with samples and exercises in our course Win7 Application Compatibility Engineer (ENG-60). Approach to Win XP to Windows 7 Migration At the point at which developers are expected to target Windows 7, PCA and UAC Virtualization can be disabled on development test machines. User Experience on Windows 7 Before Developers Target Windows 7 Program Compatibility Assistant (PCA) has at least two ways in which it can mask development issues. The first is that unless the "cancel" button is clicked each time it is presented - a marker will be put in the registry to not evaluate the same EXE again. If "Reinstall using recommended settings" is clicked, then a shim layer will also be configured in the registry and used in every subsequent run of the application. Either of these steps can result in the developer unwittingly leaving things in their software code that should be fixed. However, PCA will also automatically place some shims in - the only answer on the prompt is "OK". In these cases the shim is automatically inserted and most developers will not know how to remove it. You may configure this by the group policy setting, registry key or service configuration shown here: GPO: Computer Configuration [OR User Configuration] > Administrative Templates > Windows Components > Application Compatibility > Turn off Program Compatibility Assistant = Disable Registry: HKLM [or HKCU]\SOFTWARE\Policies\Microsoft\Windows\AppCompat\DisablePCA REG_DWORD: 1 Services: Disable "Program Compatiblity Assistant Service" UAC Virtualization is not supposed to be relied upon when software is being refactored for Windows 7. When software is refactored for Windows 7 it should include a security section in an internal manifest (as well as a compatiblity section). In most cases the manifested security level with be "asInvoker". The presence of a security manifest disables UAC Virtualization for the one application. However, if developers are unaware of this requirement, disabling UAC Virtualization on test machines will ensure that applications attempting to write back to their own Program Files folder or HKLM\Software registry key will generate an error, rather than a silent virtualization. You may configure this by the group policy setting or registry key shown here: GPO: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > User Account Control: Virtualize file and registry write failures to per-user locations = Disable Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization REG_DWORD: 0 |