Novell ZENworks 10 Configuration Management
Novell ZENworks 11 Configuration Management
UAC causes applications run as an administrator to fail with insufficient rights or accessed denied messages.
What is UAC?
UAC (User Access Control) is a feature of Windows whereby a user's highest security tokens can only be used if the user requests those high level security tokens be used and then confirms their request to use those tokens.
When UAC is enabled and a user does not BOTH request the use of those tokens AND confirms their request for the use of those tokens, the action will not be run with full administrative rights.
This explains the confusing subject, where users receive âaccess deniedâ, âinsufficient rightsâ, or similar messages, while they are logged into Windows with an account that is either member of the local administrators group or even the administrator account itself.
Requesting High Level Security Tokens for UAC:
One method for requesting access to the highest security tokens is to âright-clickâ on an application or shortcut and selectâRun as Administratorâ.
This menu item is a slight misnomer since it is not a request to run the action as the local administrator account, but rather to run the action as someone who is a member of the local administrators group.
Assuming the user is logged into Windows with an account that is a member of the local administrators group, a pop-up dialogue will appear asking permission to allow the program to make changes to this computer.
If the logged on user is not a member of the local administrator's group, it will also ask for credentials for a local administrator account it can use to make those changes.
(Note: Some UAC aware applications that know they need elevated rights, may automatically send the elevation request without the user needing to specifically perform the request, though they will still need to confirm that request assuming default UAC settings.)
UAC in Action:
Witnessing UAC in action can help users better understand the operation. On a Windows 7 PC with Default UAC settings, while logged in as a member of the local administrator's group, create a shortcut to âc:\windows\system32\cmd.exeâ on the desktop.
Launch the shortcut and navigate to the c:\windows\system32 directory. Then type the command âmd testâ. This should return the result âaccess deniedâ, even though the logged on user is a local administrator.
Next, âRight-Clickâ on the shortcut and select âRun as administratorâ. When prompted, grant permission to the application to make changes and again try to create the âtestâ directory in âc:\windows\system32â.
This time the command should work without giving an accessed denied message. This successful command would have been completed by the same logged on user, but this time the process is started with the full set of the logged on userâs security tokens.
Using a Script to Request Elevated Rights: (All Scripts are for Example purposes only and not supported by Novell.)
Applications can be configured to request elevated rights at launch via a VBS Script.
The command âWscript.exe GoNotepad.vbsâ will execute the VBS script, which launches notepad.exe so that it requests elevated rights as well as opens âmyfile.txtâ and a UAC prompt should be generated.
Set objSh = CreateObject("Shell.Application")
objSh.ShellExecute "notepad.exe", "myfile.txt" , "", "runas", 1
Automating Acceptance of Elevation Requests for Local Administrators :
The UAC Group Policy setting âUser Account Control: Behavior of the elevation prompt for administrators in Admin Approval Modeâ can be configured so that all elevations requests are automatically granted without prompting if a user is logged onto the device as a local administrator by setting it toâElevate without Promptingâ. This setting can be configured either via the Group Policy Editor to change the default local settings, a Group Policy, or by directly editing the registry. Set the registry key below and right-click on the cmd.exe shortcut again and select the âRun as Administratorâ option. There should not be any elevation prompt, but the rights should exist to create subdirectories underneath c:\windows.
Windows Registry Editor Version 5.00
Repeat the process of running the cmd.exe shortcut, but this time do not select the âRun as Administratorâ. The rights to create directories underneath c:\windows should now be absent, despite the registry key above since an elevation request has not been made.
Configuring Applications to Always Request Elevated Rights:
Programs can be configured to always request elevation on the user level via registry settings under HKCU. These registry settings are effective on the fly, so they can be set immediately prior to launching a particular application and even removed as soon as the application is launched, if so desired. Simply create a âString Valueâ underâHKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layersâ for the full path to an executable with a value of âRUNASADMINâ. Below is an example for CMD.
Windows Registry Editor Version 5.00
Create the registry entry above and then test running âcmd.exeâ without selecting theâRun As Administratorâ option. (Note: The Double Slashes are needed when creating a REG file, but only a Single Slash is used if entering the information directly via regedit) The expected result should be that an elevation request should be sent to the logged on user in the same manner as if the user had right-clicked the cmd.exe shortcut and selected the âRun as administratorâ option. The user should also be able to create directories inside of thec:\windows\system32 directory via the command prompt. If an elevation request is not always desired for the program, make sure to create a bundle action to delete the entry after the application is launched.