[DIS_UAC] and/or "request UAC on start"?

Single Click discussions / bugs

[DIS_UAC] and/or "request UAC on start"?

Postby lwc » 2019-05-31 17:01

There are currently 4 ways to prepare Single Click:
  1. Not requesting UAC on start and also not using [DIS_UAC]
  2. Not requesting UAC on start but using [DIS_UAC]
  3. Requesting UAC on start but without using [DIS_UAC]
  4. Requesting UAC on start while also using [DIS_UAC]
Can you explain the differences?

Thanks!
lwc
20
20
 
Posts: 58
Joined: 2006-08-08 11:00

Re: [DIS_UAC] and/or "request UAC on start"?

Postby Rudi De Vos » 2019-05-31 20:55

Using a manifest, we tell the OS that runas admin is required, requesting UAC on start.
This allow you to controle elevated system apps. But the user need to press the UAC allow each time

[DIS_UAC]
temp disable UAC for admin and reset it back on exit.
The disable require UAC once, but after that you don't need any user intervention to press the UAC popups.
Rudi De Vos
Admin & Developer
Admin & Developer
 
Posts: 5898
Joined: 2004-04-23 10:21

Re: [DIS_UAC] and/or "request UAC on start"?

Postby lwc » 2019-05-31 22:13

Thanks, so you say [DIS_UAC] means if system apps are run, the UAC prompt for them will be only once.
Does this mean #3 will prompt on start plus every time you launch such an app?

But what's the difference between #2 and #4?
In #2 when will be this one time prompt?
lwc
20
20
 
Posts: 58
Joined: 2006-08-08 11:00

Re: [DIS_UAC] and/or "request UAC on start"?

Postby Rudi De Vos » 2019-06-01 19:56

When you open an elevated app you get the UAC prompt
1) This run in a secure deskrop.
Because vnc is not running as service, using sc you can not press the UAC prompt and need to ask it to the user
2) Elevated apps can only b controled by other elevated apps


**If vnc doesn't run elevated you can not press the UAC popup and you can not control the elevated app, even after the user pressed the UAC OK. 1) and 2) are blocked

**Using the manifest, sc start elevated
1) Need to be done by the remote user each time it popup
2) is allowed

**Using [DIS_UAC] you actual temp disable UAC for admins (UAC setting)
To disable it the user need to press the popup once. If UAC is disabled you don't have 1) and 2)
Rudi De Vos
Admin & Developer
Admin & Developer
 
Posts: 5898
Joined: 2004-04-23 10:21

Re: [DIS_UAC] and/or "request UAC on start"?

Postby lwc » 2019-06-03 05:37

I'm sorry, it's hard to understand. What is "the mainfest"?

Does [DIS_UAC] make SC run in admin mode?

As for the bullet points, can you help out which each of them:
  1. Not requesting UAC on start and also not using [DIS_UAC] => What will happen here?
  2. Not requesting UAC on start but using [DIS_UAC] => What will happen here?
  3. Requesting UAC on start but without using [DIS_UAC] => What will happen here?
  4. Requesting UAC on start while also using [DIS_UAC] => What will happen here?
lwc
20
20
 
Posts: 58
Joined: 2006-08-08 11:00

Re: [DIS_UAC] and/or "request UAC on start"?

Postby Rudi De Vos » 2019-06-03 08:17

Not requesting UAC on start and also not using [DIS_UAC] => What will happen here?
You can only control normal apps
Not requesting UAC on start but using [DIS_UAC] => What will happen here?
You can control all apps and UAC is diabled
Requesting UAC on start but without using [DIS_UAC] => What will happen here?
You can control all apps, but you still get the UAC popup that require user intervention
Requesting UAC on start while also using [DIS_UAC] => What will happen here?
You can control all apps and UAC is diabled

Requestion UAC on start: only admins can start SC

Using [dis_uac], everybody can start sc , but natural only admins can change the uac setting, this option doesn't do anything
if you don't have permission to change it.
Rudi De Vos
Admin & Developer
Admin & Developer
 
Posts: 5898
Joined: 2004-04-23 10:21

Re: [DIS_UAC] and/or "request UAC on start"?

Postby lwc » 2019-06-04 05:35

Not requesting UAC on start but using [DIS_UAC] => What will happen here?
You can control all apps and UAC is diabled
Requesting UAC on start while also using [DIS_UAC] => What will happen here?
You can control all apps and UAC is diabled

Alright, so both these options are identical, except the second one will produce an extra prompt.
Unfortunately, this prompt sounds unneeded and yet it's a mandatory part of May 2019 Update (the only version with SecureVNCPlugin).

Also, if the user answers "no" to this prompt, will this basically ignore [DIS_UAC]?

Unless you're saying without requesting UAC on start the user is expected to right click and choose "Run as Admin" even if [DIS_UAC] is used?
lwc
20
20
 
Posts: 58
Joined: 2006-08-08 11:00


Return to SC

Who is online

Users browsing this forum: No registered users and 1 guest

cron