Hi,

I don't visit Windows much, but was doing some testing on a Win7 VM. Every time I run my FPC generated executable I get a Security Warning dialog pop up and it mentions a "Unknown Publisher", and I have to then click the 'Run' button before my application runs.

Does anybody know what is required to get rid of this Security Warning? Like I said, I don't know which much, and when I do us Windows, it's normally Win2000 which doesn't have this issue.

Regards,
- Graeme -

In our previous episode, Graeme Geldenhuys said:

Try

chmls unblock <exename>

Keep a backup of the .exe just in case.

Or try to see if there is an "unblock" in the properties of the .EXE.

If so it is because MSIE adds a note in a secondary stream that it is downloaded content from an untrusted zone. Your IE zone configuration might be a cause too.

I've seen report that it sometimes also happens when copying of (non Windows hosted) shares, but haven't seen that confirmed.

Like I said, I don't know which much, and when I do us Windows, it's normally Win2000 which doesn't have this issue.

It started with XPsp2 IIRC.

Marco van de Voort wrote

Try

...snip...

Thanks Marco, I'll give those a try.

> Like I said, I don't know which much, and when I do us Windows, it's > normally Win2000 which doesn't have this issue.

Wow, that reads terrible. My brain thought one thing, and my fingers typed another. :-/ More coffee is required!

It started with XPsp2 IIRC.

Good to know, thanks.

Regards,
- Graeme -

Am 08.04.2016 13:20 schrieb "Graeme Geldenhuys" <

Do you mean an UAC elevation dialog (with a broad yellow bar at the top), thus asking you whether you can run with elevated right or a dialog that tells you that the executable has cone from a untrusted source?

In the first case:
Does your application need administrator privileges? If not, make sure that you don't have "install" or "setup" in the name and that in the Manifest the setting is "AsInvoker" (you can check the Lazarus IDE if you're using that).
If it does require these... Well, that's by design then. Only thing you can do is to sign your application so that instead of "Unknown Publisher" it will show your own or your company's name, but code signing certificates are costly...

In the second case:
Your file either has a Alternate Data Stream (a NTFS feature) attached that marks it as coming from a insecure source. You need to remove the ADS (or simply uncheck the box) to solve this. I fathom that the "chmls unblock" from Marco does exactly that.
Alternatively it could be that you execute your application from a network drive. I think there's a setting for that somewhere as well, but I don't know that right now...

Regards,
Sven

I only get that if I run the exe from a shared network drive on Windows 7 and up. Maybe your not enabling the manifest, the laz ide does it automatically for win32.

Sven Barth wrote

Do you mean an UAC elevation dialog (with a broad yellow bar at the top),

No, see attached screenshot.

It is weird. Only some applications seem to pop up with this dialog, others don't.

This specific app doesn't require admin privileges, and doesn't use NTFS features. It's the test app for fcl-pdf, included in FPC Trunk. In this case it is a console application. On Win2000 if I double click on it, it will pop up with a console window, execute the app, then close the console window. No warning dialogs. With Win7 it immediately pops up with this warning dialog and I have to click Run first for the application runs.

I need to do some more testing to see if I can find a pattern.

Regards,
- Graeme -

Tony Caduto wrote

I only get that if I run the exe from a shared network drive on Windows 7 and up.

Ha, that was the problem! My Win7 is a VirtualBox VM, and my source code is on a VirtualBox shared folder (mapped to a drive letter in Windows 7). If I copy that executable to the C: drive, then in runs without the warning dialog.

What is the point of that? A drive letter is a drive letter. Why does it make a difference to Windows it that drive is local, or a network drive?

At least now we found the cause of the problem. Thanks Tony. It least now I know this will not happen on every Windows system. Now to figure out a solution (eventually).

Regards,
- Graeme -

Graeme,

Glad to help, that's always annoyed me as well but have never had time to fully investigate it, I imagine it's due to a signing issue like you originally thought.
If you find anything out let us know 😁
On Apr 8, 2016 8:01 AM, "Graeme Geldenhuys"
wrote:

Tony Caduto wrote

I only get that if I run the exe from a shared network drive on Windows 7 and up.

Ha, that was the problem! My Win7 is a VirtualBox VM, and my source code is on a VirtualBox shared folder (mapped to a drive letter in Windows 7). If I copy that executable to the C: drive, then in runs without the warning dialog.

What is the point of that? A drive letter is a drive letter. Why does it make a difference to Windows it that drive is local, or a network drive?

At least now we found the cause of the problem. Thanks Tony. It least now I know this will not happen on every Windows system. Now to figure out a solution (eventually).

Regards,
- Graeme -

If the exe is unsigned, then Windows will complain everytime it is run. If it is signed with a fully resolved certificate (not a self created one), then it will show the publisher in the dialog and depending on your security settings will either ask you if you want to be asked the next time or not ask this only works with paid for certificates that can trace back to one of the recognized CAs.

It only does that if the exe is executed from a location windows deems unsafe.
Even on Windows 10 my laz exes work fine with no publisher warning but as soon as you try from a network mapped drive or a UNC location bam you get the warning.

Tony Caduto wrote

It only does that if the exe is executed from a location windows deems unsafe.

I just noticed that if I run the executable from a console window (not Windows Explorer, Total Commander, Double Commander etc), then the prompt does not appear. We got to love Windows consistency. ;-)

Regards,
- Graeme -

Thats hilarious :-)

As you've worked out, this isn't an issue with the exe, it's the new security paradigm. To solve/workaround you need to let your windows know the network location is secure. From memory, internet option / security / trusted sites / add the ip of PC hosting the shared folder. Its somewhere around there. Why internet options? I guess MS thought that would be obvious :-)

Every corporate environment I've been in recently have prevented users from adding trusted sites :-(

Mike

Michael Thompson wrote

From memory, internet option / security / trusted sites /

Excellent, that did the trick - thanks! I ticked the "all network paths (UNCs)" option. I would never have found that option as I don't consider my local network as part of "Internet Options'. Oh well, that's just me.

Regards,
- Graeme -

Forgot you're not a windows user. The Internet Options I'm referring to are available through either Internet Explorer, or through Control Panel.

On the PC I'm currently I solved it the lazy way. Internet Options - Security - Local intranet - Set "Security level for this zone" to lowest possible level "low".

Mike

Graeme Geldenhuys wrote

Excellent, that did the trick - thanks! I ticked the "all network paths (UNCs)" option. I would never have found that option as I don't consider my local network as part of "Internet Options'. Oh well, that's just me.

No, it's not just you. For lots of us it was part of the horrible learning curve that was Vista. While people will tell you later Windows are better (and by and large they're right), IMO most of the better is a combination of incremental betterness and "we just got used to it". We still live with silly decisions from that era. Office Ribbons! Arrrgggghhhhhh :-)

Mike