Inno Setup installation in "All users" mode still requires Admin privileges for the non-Admin user when trying to execute the installed software

I am facing the following problem with my packaged software using Inno Setup.

I am using the following option to allow the user to choose installation for all or the current user.

PrivilegesRequiredOverridesAllowed=dialog

Now as Admin I choose to install for "All users". Of course not all of the "other users" are admins.

I install to Program Files. Then when I am logged in with a guest user I expect to run the installed software without Admin privileges. Still the created desktop icon has this "shield" in the bottom-right side, and it asks an Admin password to run the software.

It seems that the "All users" installation option means "all admin users" in my case.

I am attaching my setup.iss file. I have tried to play with every different option but nothing works.

Is my problem related to the desktop icon that is created by Inno Setup or to the options in the [Setup] section? I am pretty sure that I am missing something in the options.

[Setup]
DefaultDirName={autopf}\Pattern 3.x
PrivilegesRequiredOverridesAllowed=dialog
UsePreviousPrivileges=no

[Types]
Name: "custom"; Description: "Custom installation"; Flags: iscustom

[Tasks]
Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{cm:AdditionalIcons}"

[Components]
Name: "GEI"; Description: "GEI {#gei_version}"; Flags: checkablealone disablenouninstallwarning
Name: "GEP"; Description: "GEP {#SetupSetting("AppVersion")}"; Flags: checkablealone disablenouninstallwarning

[Files]
Source: ".\UninsIS.dll"; Flags: dontcopy
Source: ".\UninsIS.dll"; DestDir: "{code:GetDataDir}"; Check: Is64BitInstallMode()
Source: ".\UninsIS.dll"; DestDir: "{code:GetDataDir}"; Check: not Is64BitInstallMode()
;Source: ".\Softwares\{#gei}"; DestDir: {code:GetDataDir}; Flags: deleteafterinstall nocompression; Components: GEI
;Source: ".\GEP - Installation Guide.pdf"; DestDir: {code:GetDataDir}; Flags: ignoreversion sign recursesubdirs; Components: GEP
Source: ".\GEP\*"; DestDir: {code:GetDataDir}; Flags: ignoreversion sign recursesubdirs; Components: GEP

[Icons]
Name: "{group}\Pattern {#SetupSetting("AppVersion")}"; Filename: "{code:GetDataDir}\Pattern.exe"; Parameters: "--from_desktop"
Name: "{group}\{cm:UninstallProgram,Pattern {#SetupSetting("AppVersion")}}"; Filename: "{uninstallexe}"
Name: "{autodesktop}\Pattern {#SetupSetting("AppVersion")}"; Filename: "{code:GetDataDir}\Pattern.exe"; Parameters: "--from_desktop"

[Run]
Filename: "{code:GetDataDir}\{#gei}"; Parameters: "/min"; StatusMsg: "Installing GEI... please wait..."; Flags: runhidden; Components: GEI
;Filename: "{code:GetDataDir}\GEP - Installation Guide.pdf"; Tasks: StartAfterInstall; Flags: shellexec runasoriginaluser skipifdoesntexist

[Registry]
Root: "HKLM"; Subkey: "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"; ValueType: String; ValueName: "{code:GetDataDir}\Pattern.exe"; ValueData: "~RUNASADMIN"; Flags: uninsdeletekey noerror

Solution

The PrivilegesRequiredOverridesAllowed has nothing to do with the Admin "shield".

You explicitly add the "shield" yourself using this code:

[Registry]
Root: "HKLM"; \
    Subkey: "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"; \
    ValueType: String; ValueName: "{code:GetDataDir}\Pattern.exe"; \
    ValueData: "~RUNASADMIN"; Flags: uninsdeletekey noerror

If you want to add the "shield" for Admin installations only, use Check parameter to query IsAdminInstallMode:

Check: IsAdminInstallMode