Solving Least Privilege Problems with the Application Compatibility Toolkit

0
150
4 min read

(For more resources on Microsoft products, see here.)

Quick compatibility fixes using the Program Compatibility Wizard

In small enterprise environments or on home computers, compatibility fixes can be applied without using the Application Compatibility Toolkit through the user interface. If you want to know how the Windows Application Compatibility Infrastructure works in detail or if you want to deploy fixes to multiple devices, skip straight to the second part of this article: Achieving application compatibility in enterprise environments.

Applying compatibility modes to legacy applications

Compatibility fixes can be grouped together to form compatibility modes. Windows XP, Vista, and Windows 7 all come with a default set of compatibility modes out of the box. System administrators can also use Compatibility Administrator to create their own compatibility modes.

Compatibility modes can be applied directly from the user interface either by using the Program Compatibility Wizard in Windows XP, or by right-clicking on an executable file, or a shortcut to an executable file, and selecting Properties from the menu.

Windows XP contains the following compatibility modes:

  • Windows 95
  • Windows 98 / Windows ME
  • Windows NT 4.0 (Service Pack 5)
  • Windows 2000

As shown in the following screenshot, the Compatibility tab in Vista and Windows 7(left) looks a little different from Windows XP (right).

Privilege level in Vista and Windows 7
Note that the Run this program as an administrator option will be grayed out if an application manifest is included with the program.

Program Compatibility Wizard

Included in Windows Vista and later, the Program Compatibility Wizard allows users or system administrators to test legacy applications running against different compatibility modes.

  1. To launch the Program Compatibility Wizard in Windows XP, select Start | Accessories | Program Compatibility Wizard.

    To launch the Program Compatibility Wizard in Windows Vista, type the following command into the Search box on the Start menu:
    %systemroot%System32mshta.exe res://acprgwiz.dll/compatmode.hta
    To launch the Program Compatibility Wizard in Windows 7, search for program compatibility troubleshooter in Start | Help and Support.

  2. Click Next on the welcome screen in Help and Support Center.
  3. Leave the default I want to choose from a list of programs option selected and click on Next.
  4. Select the application you want to test, in this case Maxthon, from the Select a program list and click on Next.

  5. Choose a compatibility mode from the list, such as Microsoft Windows 95 or Windows 2000, and click on Next.

    Compatibility modes set using the Program Compatibility Wizard only apply to the currently logged in user. Compatibility settings in Vista and Windows 7 can be applied to the logged in user or to all users.Administrative privileges are required to apply compatibility settings for a given application to all users of a system.

  6. If required, select display settings (256 colors or 640 x 480 screen resolution) to be used with the program and then click on Next.
  7. Click Next to test the compatibility mode against your application.

The application will launch and you can test it to see if the selected compatibility mode resolves the identified problems. Once you’ve finished testing, close the application. Back in the Help and Support Center, choose to either apply the compatibility settings or try different settings.

Browsing compatibility settings for each user
If compatibility modes are set on programs for specific users, you can use Compatibility Administrator to browse the settings for each user under the Per User Compatibility Settings node. This node only appears if per user settings are found on the system.

Program Compatibility Assistant

Introduced in Windows Vista, the Program Compatibility Assistant helps to automate the process of applying compatibility fixes to legacy applications by monitoring for known problems when programs are running. This feature runs as a service, and prompts users to apply suggested fixes for applications, either during the setup phase or when running an installed application. The Program Compatibility Assistant can detect the following problems automatically:

  • Errors when launching setup programs
  • Failures in install routines
  • Failures caused by User Account Control
  • An install needing to run as an administrator
  • A control panel applet requiring administrative privileges
  • Errors caused because a component is not present in the current version of Windows
  • Notifying users about unsigned drivers on 64-bit versions of Windows
  • Matching applications against a list of programs with known problems and notifying the user at program startup

The Program Compatibility Assistant intercepts an installation routine, prompting the user to try again using recommended settings.

Disabling the Program Compatibility Assistant

The Program Compatibility Assistant is intended to help home users resolve problems with legacy applications. In an enterprise environment, to avoid potential problems with messages generated by the Program Compatibility Assistant, you should consider disabling the service in Group Policy. The Turn off Program Compatibility Assistant setting can be found in the Group Policy Management Editor under Computer or User Configuration | Policies | Administrative Templates | Windows Components | Application Compatibility.

Excluding executables from the Program Compatibility Assistant

The Program Compatibility Assistant doesn’t monitor programs that have an application manifest that marks them as compatible with Vista or Windows 7. However, if you want to exclude a program but don’t want to disable the Program Compatibility Assistant completely, you can create a REG_MULTI_SZ registry value named ExecutablesToExclude under the following key:
HKLM SoftwareMicrosoftWindows NTCurrentVersionCompatibility Assistant

LEAVE A REPLY

Please enter your comment!
Please enter your name here