I’m developing a custom installer for my application, because I need to configure some peculiar settings that InnoSetup and other similar tools don’t allow. The installer requires administrator privileges to perform the necessary configurations. At the end of the installation, it starts the newly installed application.

The problem is that this application is also launched with administrator privileges, inheriting the installer’s permissions. This happens regardless of the method used to launch the application: CreateProcess, CreateProcessAsUser, ShellExecute, and even the obsolete WinExec.

In summary, my question is: From an application running with administrator privileges, how can I start another application with the “normal” privileges of the logged Windows user?