I've been using Vista for a good few weeks now, and it's only today that I've hit my first UAC problem - you can't "unblock" a file that's been marked as downloaded if you don't have full permissions to it.
Internet Explorer has a feature called Persistent Zone Identifier. When you download a file from a site, the file saved to the hard disk is marked with the site's security zone (e.g. Internet Zone). When you try and run that program, the shell will notice the identifier and display a warning that you are trying to run a file from an untrusted source. It's a nice little security feature.
XP took it a step further. If you have a zip file with a persistent zone identifier, XP's built in zip tool would pass the identifier on to the files it extracted, so any executables you downloaded in a zip file were still subject to the same zone check. Defence in depth.
Vista appears to trump XP. It not only keeps the id for extracted files, but appears to apply it to any files created by a program that is marked with a zone id!
I downloaded a zip file containing a setup program. I extracted it with the built in zip tool (or maybe I just double clicked the setup program while inside the zip folder view, I forget which) and installed the program. It starts up as you log in, and suddenly I'm greeted by the warning dialog - I'm trying to run software downloaded from the internet.
To stop the dialogs, you can do one of two things; uncheck the tick box on the warning itself, or display the executable file's properties and click "unblock". Neither of which work if you're running with UAC and the files are installed to Program Files, and neither option prompts you for elevation. It silently fails. And you can't elevate explorer itself while browsing the folder, so you're kind of stuffed. And running the file elevated gets the warning prompt before the elevation prompt (it runs in explorer's context, so you've got no hope).
But where there's a will, there's a way. This rather useful runmenu tool allows you to run the following command from an elevated command prompt:
runmenu /verb:properties /wait:window file.exe
and you get the file properties dialog open and can successfully unblock the file. (The "wait" is very important)
Msdn has more details about the Persistent Zone Identifier, but it doesn't mention the little tidbit that the identifier is stored in an NTFS stream called "ZoneIdentifier".
Subscribe