I installed XSplit just to test it out on a Windows computer. XSplit is asking to run as administrator on the computer every time it runs. That cannot be right? That is a basic violation of every good security rule for applications these days. Is there any way to configure XSplit to run in the context of an ordinary user with no special privileges?
+ Reply to Thread
Results 1 to 9 of 9
From the XSplit forum:
MAY 30, 2016 06:56PM HKT
SplitmediaLabs Limited Agent
Thank you for contacting us regarding your concern, kindly allow me to assist.
Xsplit Broadcaster was designed to need admin privileges to be able to access sources and other assets from the system. Access rights from an administrator needs to be provided every time.
There is no function on Xsplit that enables to have the access needed not be provided by an admin
It seems to me that this is a result of a poorly written installer, otherwise the necessary permissions would be granted during installation so as not to need Administrator rights every time. Thousands of other programs achieve this just fine, so I would think that these should be able to as well.Do or do not. There is no "try." - Yoda
You can start the program without elevation from a command prompt by:
C:\> set __compat_layer=runasinvoker C:\> xsplit.Core.exe
If it works one can either edit the manifest or build a launcher to start the program without prompting.
That any application developer selfishly writes an application to run as administrator in 2017 is complete and total BS. People should shame XSplit at every possible opportunity for the worst programming and product management decision possible.
As a purely practical matter, no application should need admin privileges. If they need to occasionally write to Program Files or ProgramData that could be done with the standard UAC interface.
This is just disgusting!
The program I mentioned earlier is the only program I use that requires elevation every time I run it. I have plenty of other programs that store their settings in the Registry, and access files in the Windows System folders, but they were installed with the necessary permissions. Since you have to grant permission for the installer, everything should be set up during that process, and you should never need to grant permission again. The only exception might be utilities such as file recovery software, that often need more aggressive access to the entire system, so they ask permission before they attempt certain functions.
However, if you really want to know what resources it needs access to that require admin access, you'll need to direct your inquiry at XSplit support. And if they can't satisfy your concerns, you'll have to consider using a different program. I can't believe that they are the only software that can accomplish what they do. And if they are, then you have to weigh your need for that function against your security concerns.Do or do not. There is no "try." - Yoda
1) You are being notified *when* and *how often* an application needs these privileges.
2) You are able to judge if the permission is an appropriate response to your actions. If you are adding a new component to the system, that is a logical moment to ask for admin permissions, to support downloading files to a sensitive file system location. If they are asking for this permission 15 times per hour for no particular reason, there is a very big security problem.
To be fair, the program does work without admin privileges, the few things I tried. I don't have any games to try on my virtual machines really, but screen capture works.
You need to do two things:
1. Give users write permission to the folder C:\Program Files (x86)\SplitmediaLabs\XSplitBroadcaster
The program writes temporary files to its installed folder. This is very bad practice. Don't do this on a secure computer and/or a computer with AppLocker configured. Just avoid this program then. Edit: Or choose a different install path, like C:\ProgramData\SplitmediaLabs\XSplitBroadcaster
2. Change a line in XSplit.Core.exe.manifest:
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
Last edited by andkar; 30th Mar 2017 at 03:49. Reason: To add
So the only real requirement here is for them to run as admin is to be able to put new modules that are installed and activated onto the file system, and conversely to remove things that are uninstalled?
If that is all they need it would not be hard for them to rewrite the application to be secure. But, until then, they could at least run as normal user and then invoke UAC on what should be very rare occasions when new modules are downloaded by the user.
A properly written program should install a driver or a service with no user interface to handle such tasks though.
But one can always right click and run as administrator if it's only on rare occasions you need to run as admin.
I really don't understand developers who create programs that aren't allowed or are difficult to run in most organisations, personally I would like to have as large customer base as possible. I fight with such programs almost on a daily basis, however. It's 2017 last time I checked.