Can I have WingetUI start as admin so it never prompts me for admin permission/approval/access?

[IMTheNachoMan (imthenachoman)]

Yes, I understand the risks.

I basically want to log into my computer, have WingetUI start, it auto update, and it never, ever, ask me for admin permission/approval/access because it already has it.

I think I need to somehow get WingetUI to start as admin, right? But how?

[Spacellary (Spacellary)]

For that you can look up how to "Run Scheduled Task as Administrator in Windows".

Basically you'll have a scheduled task run by SYSTEM at Logon, with the highest privileges.

Since you already understand the security risks involved I won't go through that.

This article should be helpful:

https://www.thewindowsclub.com/how-to-run-scheduled-task-as-administrator-in-windows

[IMTheNachoMan (imthenachoman)]

Thanks.

For the sake of the discussion, are there any unobvious security risks? The way I see it, if my machine has a good login PW, and I trust all the packages I have used winget to install/update, then there is no new risk (for me and my use-case). But I'm wondering if there is anything unobvious I'm not seeing. It's been a while since I looked at Windows security.

[Spacellary (Spacellary)]

I can only speak for myself but if you trust WingetUI and the packages you have installed, there shouldn't be any surprises. The exception would be if WingetUI was hijacked in some way or my some other software, but this is valid for anything else you'd run with elevated privileges so the rule of being careful with software and preferably using OSS when possible is still valid and your best protection.

Cheers!

[IMTheNachoMan (imthenachoman)]

Yeah. I am security architect/engineer for my company. So I take security seriously. But sometimes it's so exhausting.

[Benjamin Smith (dbensmith)]

One thing I needed but couldn't find documented until I looked up the autorun entry for WingetUI:

To prevent the app from launching a window at logon, use the --daemon flag on WingetUI.exe.

[didi8517]

Thanks Spacellary (@Spacellary) for the answer, I was also looking for a solution, but it hasn't worked quite the way I hoped. I guess my problem may also go a little farther than the orignal question, more like in this issue (#3670), that even with all the elevations, that some installers ignore that and ask again. I had hoped that running UniGetUI under system user that that would also be solved, but unfortunately not. Is that just the way it is, or may I have made a mistake in my task configuration/etc...?
Thanks!

[pablo (vieira-temes)]

Sorry to resurrect this discussion, but I'm having a little issue.

I'm starting UniGetUI with a Scheduled Task with elevated privileges at logon (I disabled the Startup Manager entry before doing so). It seems to be working but the tray icon doesn't show up. If I use a deep link from Firefox (unigetui://showUniGetUI) it opens instantly without showing any splash screen, so I guess it is indeed running in the background. The tray icon stays after I close the UniGetUI window.

If I don't use any automated startup and start UniGetUI manually as administrator, the tray icon does show up immediately.

Any idea what might be going on?

[Martí Climent (marticliment)]

Please see the logs, and check if there is any exception there.
Also, please try to give UniGetUI a 5/10 second delay after logon, and see if it helps

[didi8517]

My guess is pablo (@vieira-temes) is using the System user scheduled task from the answer? I've tried that as well, and also noted that there's no windows, no icon ... But I just thought it to be normal, since it's running on a different user - right?

[Benjamin Smith (dbensmith)]

Correct, running UniGetUI as SYSTEM means we won't see a tray icon while logged on as a different user.

In this case expected behaviour is likely different from the average user's intended behaviour. I assume most users trying this will expect that they can still see the tray icon and UI. Running as SYSTEM is, I imagine, mostly intended to remove the pain points of having to approve an elevated prompt every time the user logs in and/or a way to have the service start at startup rather than login.

I worked around it by having my scheduled task run as administrator under my own user account at logon. It is also delayed by ~60 seconds or so after login. The downside is that I have to actually log in for UniGetUI to start, but that is sufficient for my use case.

[didi8517]

Well, I also tried the System user, since running it under my account, even with highest privileges, still request for elevation poped up - but that seems to be something that is inevitable, since that depends on the installer itself ignoring any previous/cached elevation...
pablo (@vieira-temes) : going back to the terminal, my guess is this same issue/problem will persist, right? Or have you found another way of winget automatically updating all things without any popups?

[pablo (vieira-temes)]

To be honest, I haven't checked. I went back to the terminal because I only use winget (no choco and others) and I just decided to do a weekly winget upgrade --all manually. But you're probably right and some installers will ask for elevation no matter what, so fully automating this is essentially impossible. I'm also considering going back to Ubuntu...

[pablo (vieira-temes)]

I stopped using UnigetUI. I'm back to using winget at the terminal.

[gmhall (gmhall506)]

I'm using UniGetUI and frustrated by the elevation to admin issues. Great, and needed, concept ... just seems fraught with complications. Running Win 11 as an admin user (not recommended) all is OK. As standard user (preferred) no privilege elevation satisfies the requirements -- all updates fail. I'll now experiment with running UniGetUI "as administrator" but it warns that it's not recommended and system tray icon turns blue. I think I must be missing something?

[Martí Climent (marticliment)]

what do you mean all updates fail? Don't they throw a UAC dialog?