User Account Control Message Appearing When Opening Standalone

vincedmet
A curator I'm helping with Zotero is receiving the following message when she clicks on her standalone icon to open the program:

"Do you want to allow the following program from am unknown publisher to make changes to this computer?

Program name: updater.exe
Publisher: Unknown
File Origin: Hard drive on this computer

Yes/No"

The curator then clicks "No" and the standalone opens without any problems, but I thought I should post this in case it's a sign of something not working as it should with the program. I believe she has the latest version of Zotero since I updated it for her a few weeks ago.

Anyone else getting this message?
  • bwiernik
    That’s Zotero trying to update itself to a newer version. It looks like you installed Zotero as an an administrator, which isn’t necessary and can lead to this at update time. You should uninstall and reinstall Zotero. If you are prompted to enter an administrator password, click Cancel instead.
  • vincedmet
    I couldn't have installed Zotero as an administrator on this PC because the librarians don't have admin rights at my institution. So the only way we can install Zotero is by clicking "No" when we get prompted for an admin logon in the installation process. Doing so allows us to bypass that step and then install wizard comes up directly.

    Should I just try to update the usual way, by going to Help>Check for Updates in the curator's standalone?

    To uninstall and reinstall I will have to get our IT department involved (we can't bypass admin rights on the uninstall). Also, what happens to someone's library when you uninstall Zotero? Currently, the curator's Zotero data directory is on her personal drive on the network (backed-up nightly).

    Thanks.

  • dstillman
    edited January 31, 2018
    That also shouldn't be "Publisher: Unknown", though. There was an unsigned version of Zotero released for a day in mid-December, so it's possible she still has remnants of that. Explained below. She should reinstall from the download page, and let us know if she gets that message again. Anything from Zotero should be signed as coming from the Corporation for Digital Scholarship.
  • vincedmet
    Okay thanks. Once I've resinstalled the standalone, I would then just go to Edit>Preferences>Advanced>Files and Folders and point to her data directory location, correct? This would "repopulate" her standalone with her library, I assume.

    Right now, the data directory is on the network drive so I know it's safe and backed-up.
  • dstillman
    No, all settings and data are preserved on reinstall — you shouldn't need to touch anything. It just affects the code that runs.
  • vincedmet
    Thank you again, dstillman. One last question - do I need to uninstall or can I just re-install? I ask because we need to get our IT department to uninstall (from add/remove programs) and they are never happy about that.
  • dstillman
    Just reinstall.
  • dstillman
    edited January 31, 2018
    Oh, I realized what happened here. While we did have one unsigned release out for a day in December, that's not what this is.

    Zotero's code-signing certificate expired in mid-January, and while we put out a new release with an updated code-signing certificate before then, the previous version didn't use timestamping on the signed files, which means that, if you run one of the bundled programs for the first time after the certificate expires, Windows identifies it as an unknown publisher. Since the updater program is only run for the first time at update time, anyone who didn't update before the certificate expired would get this warning with "Publisher: Unknown".

    All Zotero releases going forward are signed with timestamping, so this won't be an issue in the future.

    If you're seeing this message now, it doesn't indicate a problem, but since it's good not to get in the habit of running unsigned software, it's better to download Zotero from the download page and reinstall it that way.

    Sorry for the trouble.
  • vincedmet
    Thanks for this update. I will then go ahead and reinstall Zotero from the download page for this curator.
  • leejones
    Sorry to bump an old thread but I am having a very similar issue. Everytime I launch Zotero stand-alone, I also get the User Account Control window, but it lists "verified publisher: Corporation for Digital Scholarship", not "publisher: unknown". It seems to be asking for authorisation just to launch the Zotero auto-updater as when I click "yes", a window briefly appears, checking for updates. It's not a big deal to click "yes", but it does happen every time and it would be convenient to stop it happening.
  • bwiernik
    Zotero was installed with Administrator Privileges, which aren’t necessary for Zotero at all and will require elevation for all updates. You should uninstall Zotero and reinstall without administrator privileges.
  • leejones
    Thanks very much, that did solve the problem. Not sure how it got installed with Admin privileges, but hey.
  • dstillman
    Just to close out this thread, the UAC prompt is normal and expected behavior on Windows when Zotero updates itself, and it doesn't mean that you installed Zotero as an administrator. It won't be shown on most updates, but it will be shown occasionally. As long as it says the updater is signed by Corporation for Digital Scholarship, it's safe to proceed.

    If you're seeing the prompt repeatedly despite saying Yes, that does indicate a problem, and your best bet then is indeed to uninstall and reinstall Zotero as bwiernik says.

    See this thread for further details.
This discussion has been closed.