Because software must be careful about requiring admin privileges (for example, why should calc.exe require admin privileges), you must be careful about using features that require admin privileges. This includes writing user preferences or data to protected registry hives (like HKEY_LOCAL_MACHINE) or directories (like %WINDIR%), and many more. If, at times, your software requires admin privileges, either be prepared to catch SecurityException or similar exceptions (the BCL method documentation should state what could be thrown), or use Code Access Security (CAS) - namely the PrincipalPermission, to either declaratively or imperatively demand permissions with a certain group. A good starting point to learn CAS is Understanding .NET Code Access Security[^] right here on CodeProject. Be sure to follow the links. So, if you had a method that required Admin privileges (say to enumerate a certain protected DC in Active Directory), you could code your method like so:
[PrincipalPermission(SecurityAction.Demand, Role="Administrators")]
public IEnumerator GetADEnumerator(string path)
{
// ...
}
Do note that using the PrincipalPermissionAttribute or PrincipalPermission (for declarative security) does require to either hard-code a domain name (i.e., "MYDOMAIN\Domain Admins") or to use a local group where a domain or machine name isn't required). In these cases, catch exceptions is a better choice (and should be done anyway since calling a protected method using CAS will still throw an exception). This posting is provided "AS IS" with no warranties, and confers no rights. Software Design Engineer Developer Division Sustained Engineering Microsoft [My Articles]
