WebView2 online and offline installation require elevation

[dave-q]

Issue Reading the documentation here https://docs.microsoft.com/en-us/microsoft-edge/webview2/concepts/distribution#online-only-deployment it states the both the bootstrapper link and the run time bootstrapper require elevation

Currently, both the bootstrapper and standalone installer only support per-machine install, which requires elevation. When run without elevation, a Windows User Account Control prompt appears to ask users to elevate permissions.

Details This essentially prevents us from being able to use WebView2. Our application is installed across many companies, lots of them large enterprises who do not grant admin privileges to users. Our application is a click once app that does not require any elevation to be installed and we have to keep it that way.

Request

We'd like this to not require elevation to be installed

AB#29631700

[champnic]

Hi @dave-q, when you say your app is used by enterprises, do you mean enterprises are deploying the app to their employees' machines, or that the employees tend to use the app themselves?

If the enterprise is doing the deployment, they should be able to deploy the WebView Runtime to machines themselves, similar to how they can deploy a browser or other app.

If your scenario is an enterprise employee trying to install your app, then indeed this would be blocked. I've opened an item on our backlog to track this. Thanks!

[dave-q]

Hi,

Thanks for the reply.

We probably have a mixture of both but mainly it's installed by the end user themselves.

Even when the installation is managed by the company, having the app installation require elevation is going to raise more questions and mean it has to go through more checks (I know it would at my company at least).

Thanks for opening a back log item.

[dave-q]

Hi @champnic,

I was just wondering if there's any update on this or even any rough timelines of when we might know more about this?

Thanks

[champnic]

No update yet. We're doing a lot of work in the distribution space in general, so I'll probably know more soon about where this falls in the general priority of work soon. Feel free to ping again in two weeks if I haven't responded.

I would imagine January or Feb at the latest.

[dave-q]

Hey @champnic just dropping in to see if there were any updates.

Thanks

[dave-q]

@champnic hello and happy new year! Just wondered if there was any news with this issue? Thanks

[champnic]

Happy New Year!! Sorry for the delay - unfortunately it doesn't look like we'll get to the work this quarter. There's been a shift in focus to try and get the runtime deployed to existing machines (so that installation isn't required) and to make sure it's in the next release of Windows. However, we won't have 100% coverage so this is definitely still on our radar.

[timbeaudet]

I'm subscribing as it would be great to run the redistributable without required elevated permissions!

[dqwork]

@champnic (i'm the original poster using my 'work account' now since its work related)

That sounds promising but as you said it will take time to get 100% coverage, so while its good that 'most' people will get the run time from the windows updates, since we can't guarantee that have it, we are still left having to bundle all those binaries with our application and manage updates ourselves, which is not ideal. I understand its not top of the backlog, but just adding my vote that I think this should still be looked at :)

Thanks for keeping us up to date with developments, its really appreciated.

[geolehmann]

I´m looking really forward to this too. I develop apps using Webview2, and I want users to be able to use my apps without having to install the Webview2 Runtime first

[bfioca]

This is pretty major for RescueTime's new version. WebView2 lets us add a LOT of useful features that make us want to heavily promote our application (especially on Windows) and the Admin privilege requirement really puts a burden on our users.

[NDeanRoblox]

@champnic Are there any updates on this issue? Many of our users do not have admin privileges.

I see that the current focus is on shipping WebView2 with Windows 10. Are there any plans to do the same for Windows 7? If not, it would be fantastic to have a workaround for requiring admin privileges.

[exaiwitmx]

The automatic update of an Evergreen install also requires elevation. Normal users do not have admin privileges. So, the new version has to be deployed by automatic software deployment as soon as a new version of the runtime is available. Otherwise, the elevation dialog will appear out of nowhere and confuse normal users.

[champnic]

We're currently looking at our options to avoid elevation right now, but I don't have a timeline yet for when this work will be completed.

[liminzhu]

Hey folks, we’re currently evaluating a couple potential options (not final) to install WebView2 without elevation and we would love to hear any input/preference from you all.

Option 1 - We can expose a small online installer (and a stable link to it so that you can download it from the client device rather than) and a full offline installer that can install WebView2 without elevation. The developer experience of using those would be similar to our current per-system installer (see online-only and offline deployment on https://docs.microsoft.com/en-us/microsoft-edge/webview2/concepts/distribution#online-only-deployment). Essentially, your installer will be detecting if WebView2 is already installed, and if not chain install our installer that is either packaged with your installer or downloaded on the fly.

Option 2 - We can expose an installWebView2 API inside our SDK that installs WebView2 without elevation. It’s likely a simpler developer experience if your install stack can include our header and call our API, or you're just trying to call it at app runtime, but it may be complicated if your install stack can't call arbitrary APIs (WiX may be an example). Another callout is that the API cannot handle offline install (because under the hood the API is basically doing the online-only deployment flow in option 1).

[exaiwitmx]

Hello @liminzhu,

could you please explain what these two options would mean regarding automatic updates? Can we also expect that they won't require elevation?

[dave-q]

Mmm our app I a hosted click once application, so I'm not sure what would be better. Is option 2 essentially an API to install it whenever you want, during the running of the app? This sounds like something we'd take a look at at. Otherwise I'm not sure how we would inject the online installer into the clickonce install

[champnic]

@exaiwitmx Correct - Once installed the automatic updates don't require further elevation.

[ApolonTorq]

From a timing perspective, whichever option can be made available sooner is preferred. If there is no difference in option availability timing, the simple developer experience of Option 2 would be preferred with a C# based API provided as a Nuget package.

[JaseRandall]

@liminzhu @champnic

Would there be an update to the time frame as to when a WebView2 installer not requiring elevation will become available?

Unfortunately, not all enterprises update to the latest version of Windows 10 as quickly as they are released. As suggested in the previous comment, a Nuget package would be very handy.

[liminzhu]

This is something we're working on right now! While I don't have an exact timeline, roughly I expect this to be in the next few months and within the year.

[tbolon]

Hey folks, we’re currently evaluating a couple potential options (not final) to install WebView2 without elevation and we would love to hear any input/preference from you all.

Hello. Option 1 would better a better solution in our case. We were ready to instruct our users to install the runtime by themselves, or warn the that we need it then download and start the UI. The only blocker was the fact that often they don't have administrator privilege (and are often small companies).

[Laicure]

Hoping this gets resolved. We have a lot of portable apps that will benefit on this non-admin runtime. My company's IT department doesn't like this kind of requests. Client-side, also, raises a lot of questions and hassle just to have this installed even if the installer is from Microsoft.

[LadderLogic]

Any update to the release timeline for this feature (ballpark/accurate) would be great! We don't want to open the pandora box of shipping our own webview2 runtime if we could avoid it.

[joe-udwin-lrn]

liminzhu commented on 24 Aug: This is something we're working on right now! While I don't have an exact timeline, roughly I expect this to be in the next few months and within the year.

@liminzhu any update? We are all very eager!

[liminzhu]

@Joe-U-Questionmark should be fairly soon and within a couple of releases. We're validating the product now.

[liminzhu]

Hi folks! Some update in this space, tl;dr is we're updating the installer so that it can be installed without elevation.

https://github.com/MicrosoftEdge/WebView2Announcements/issues/37

[geolehmann]

this is great news!

[rgdawson]

I have not seen an official announcement update, but evergreen installers (signed on 9 Dec 21) appears to not require elevated privileges. It seems to run non-elevated (per user) unless you explicitly run the installer as administrator. Anyone know the status?

[champnic]

Here was the update from yesterday: https://github.com/MicrosoftEdge/WebView2Announcements/issues/37#issuecomment-994208288

As noted, we'll be updating our docs soon to reflect this change. Thanks!

[champnic]

Docs have been updated, including a new registry key to check for the per-user installations. https://docs.microsoft.com/en-us/microsoft-edge/webview2/concepts/distribution#installing-the-runtime-as-per-machine-or-per-user

Thanks!