XSplit Trying to Run as Admin Under Windows?

[pone44]

I installed XSplit just to test it out on a Windows computer. XSplit is asking to run as administrator on the computer every time it runs. That cannot be right? That is a basic violation of every good security rule for applications these days. Is there any way to configure XSplit to run in the context of an ordinary user with no special privileges?

[awgie]

From the XSplit forum:

Adrian Cabrera
MAY 30, 2016 06:56PM HKT
SplitmediaLabs Limited Agent
Hello,

Thank you for contacting us regarding your concern, kindly allow me to assist.

Xsplit Broadcaster was designed to need admin privileges to be able to access sources and other assets from the system. Access rights from an administrator needs to be provided every time.
There is no function on Xsplit that enables to have the access needed not be provided by an admin

I don't use XSplit myself, but I do use VOB2MPG (yes, I know, completely unrelated program, but it presents the same problem). It asks for admin privileges every time I run it, because it stores its setting in the Windows Registry, so it needs admin access to be able to change any of those settings.

It seems to me that this is a result of a poorly written installer, otherwise the necessary permissions would be granted during installation so as not to need Administrator rights every time. Thousands of other programs achieve this just fine, so I would think that these should be able to as well.

[andkar]

You can start the program without elevation from a command prompt by:

C:\> set __compat_layer=runasinvoker
C:\> xsplit.Core.exe

It asks me to log in so I didn't investigate further. You will probably get access denied errors, if the program truly needs elevated privilegies but there is no harm in trying. Unless it does some ugly things with the hardware it should be fixable by granting access to the needed registry keys and/or files.

If it works one can either edit the manifest or build a launcher to start the program without prompting.

[pone44]

From the XSplit forum:

Adrian Cabrera
MAY 30, 2016 06:56PM HKT
SplitmediaLabs Limited Agent
Hello,

Thank you for contacting us regarding your concern, kindly allow me to assist.

Xsplit Broadcaster was designed to need admin privileges to be able to access sources and other assets from the system. Access rights from an administrator needs to be provided every time.
There is no function on Xsplit that enables to have the access needed not be provided by an admin

I don't use XSplit myself, but I do use VOB2MPG (yes, I know, completely unrelated program, but it presents the same problem). It asks for admin privileges every time I run it, because it stores its setting in the Windows Registry, so it needs admin access to be able to change any of those settings.

It seems to me that this is a result of a poorly written installer, otherwise the necessary permissions would be granted during installation so as not to need Administrator rights every time. Thousands of other programs achieve this just fine, so I would think that these should be able to as well.

As a worst case, if they needed elevation during program use, that should be done by the standard method, which is to warn the user under Windows that an application requires elevation, and allow the user to consent to that.

That any application developer selfishly writes an application to run as administrator in 2017 is complete and total BS. People should shame XSplit at every possible opportunity for the worst programming and product management decision possible.

As a purely practical matter, no application should need admin privileges. If they need to occasionally write to Program Files or ProgramData that could be done with the standard UAC interface.

This is just disgusting!

[awgie]

As a worst case, if they needed elevation during program use, that should be done by the standard method, which is to warn the user under Windows that an application requires elevation, and allow the user to consent to that.

That any application developer selfishly writes an application to run as administrator in 2017 is complete and total BS. People should shame XSplit at every possible opportunity for the worst programming and product management decision possible.

As a purely practical matter, no application should need admin privileges. If they need to occasionally write to Program Files or ProgramData that could be done with the standard UAC interface.

This is just disgusting!

It's the same thing. By clicking 'Yes' in the UAC dialogue, you are granting the program admin privileges (that's why normal users have to provide an administrator password).

The program I mentioned earlier is the only program I use that requires elevation every time I run it. I have plenty of other programs that store their settings in the Registry, and access files in the Windows System folders, but they were installed with the necessary permissions. Since you have to grant permission for the installer, everything should be set up during that process, and you should never need to grant permission again. The only exception might be utilities such as file recovery software, that often need more aggressive access to the entire system, so they ask permission before they attempt certain functions.

However, if you really want to know what resources it needs access to that require admin access, you'll need to direct your inquiry at XSplit support. And if they can't satisfy your concerns, you'll have to consider using a different program. I can't believe that they are the only software that can accomplish what they do. And if they are, then you have to weigh your need for that function against your security concerns.

[pone44]

As a worst case, if they needed elevation during program use, that should be done by the standard method, which is to warn the user under Windows that an application requires elevation, and allow the user to consent to that.

That any application developer selfishly writes an application to run as administrator in 2017 is complete and total BS. People should shame XSplit at every possible opportunity for the worst programming and product management decision possible.

As a purely practical matter, no application should need admin privileges. If they need to occasionally write to Program Files or ProgramData that could be done with the standard UAC interface.

This is just disgusting!

It's the same thing. By clicking 'Yes' in the UAC dialogue, you are granting the program admin privileges (that's why normal users have to provide an administrator password).

The program I mentioned earlier is the only program I use that requires elevation every time I run it. I have plenty of other programs that store their settings in the Registry, and access files in the Windows System folders, but they were installed with the necessary permissions. Since you have to grant permission for the installer, everything should be set up during that process, and you should never need to grant permission again. The only exception might be utilities such as file recovery software, that often need more aggressive access to the entire system, so they ask permission before they attempt certain functions.

However, if you really want to know what resources it needs access to that require admin access, you'll need to direct your inquiry at XSplit support. And if they can't satisfy your concerns, you'll have to consider using a different program. I can't believe that they are the only software that can accomplish what they do. And if they are, then you have to weigh your need for that function against your security concerns.

It is NOT the same at all:

1) You are being notified *when* and *how often* an application needs these privileges.

2) You are able to judge if the permission is an appropriate response to your actions. If you are adding a new component to the system, that is a logical moment to ask for admin permissions, to support downloading files to a sensitive file system location. If they are asking for this permission 15 times per hour for no particular reason, there is a very big security problem.

[andkar]

To be fair, the program does work without admin privileges, the few things I tried. I don't have any games to try on my virtual machines really, but screen capture works.

You need to do two things:

1. Give users write permission to the folder C:\Program Files (x86)\SplitmediaLabs\XSplitBroadcaster

The program writes temporary files to its installed folder. This is very bad practice. Don't do this on a secure computer and/or a computer with AppLocker configured. Just avoid this program then. Edit: Or choose a different install path, like C:\ProgramData\SplitmediaLabs\XSplitBroadcaster

2. Change a line in XSplit.Core.exe.manifest:

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

to

<requestedExecutionLevel level="asInvoker" uiAccess="false" />

[pone44]

To be fair, the program does work without admin privileges, the few things I tried. I don't have any games to try on my virtual machines really, but screen capture works.

You need to do two things:

1. Give users write permission to the folder C:\Program Files (x86)\SplitmediaLabs\XSplitBroadcaster

The program writes temporary files to its installed folder. This is very bad practice. Don't do this on a secure computer and/or a computer with AppLocker configured. Just avoid this program then. Edit: Or choose a different install path, like C:\ProgramData\SplitmediaLabs\XSplitBroadcaster

2. Change a line in XSplit.Core.exe.manifest:

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

to

<requestedExecutionLevel level="asInvoker" uiAccess="false" />

Good suggestions and thank you.

So the only real requirement here is for them to run as admin is to be able to put new modules that are installed and activated onto the file system, and conversely to remove things that are uninstalled?

If that is all they need it would not be hard for them to rewrite the application to be secure. But, until then, they could at least run as normal user and then invoke UAC on what should be very rare occasions when new modules are downloaded by the user.

[andkar]

So the only real requirement here is for them to run as admin is to be able to put new modules that are installed and activated onto the file system, and conversely to remove things that are uninstalled?

It seems so by my quick tests, but it might need higher privileges for some other tasks I haven't tried. I can imagine capturing video overlays or some games might need higher permissions.

A properly written program should install a driver or a service with no user interface to handle such tasks though.

But one can always right click and run as administrator if it's only on rare occasions you need to run as admin.

I really don't understand developers who create programs that aren't allowed or are difficult to run in most organisations, personally I would like to have as large customer base as possible. I fight with such programs almost on a daily basis, however. It's 2017 last time I checked.