UAC and Administrator privileges

[wallyinnc]

Hi everybody
I have one Adminstrator account, for myself, and Standard Users for my kids.

There are a few programs from ASUS (update checker etc) that run at startup without a UAC notification when I log in to my account, but will ask for the Admin password when logging in the Standard User accounts. I can't get a snapshot of it since UAC disables everything (can I?)

I have tried to followng:
- set the programs to run as Administrator, per this tutorial (http://www.sevenforums.com/tutorials/11841-run-administrator.html?filter[2]=Security System Tools)
- Gave "Users" full control of the programs
- Gave a specific account both full control and ownership of the programs. UAC still asks for the password when logging into that account

I have Parental Control turned on. Would that cause this issue (the dialog box I get is UAC)?

There is no apparent issue when we deny the access via UAC and the programs do not load. I would prefer that they load accordingly though.

 

[sup3rsprt]

Well the problem is that the ASUS programs require administrator privileges. Maybe you should disable those programs for your kids and just leave them enabled for your account. Is that an option?

BTW, have you tried it this way?

http://www.sevenforums.com/tutorials/11949-elevated-program-shortcut-without-uac-prompt-create.html

Maybe you can configure those programs to run automatically under your username and password. Kind of like how you can configure services to run under a certain account (by having the computer remember the credentials for that account).

 

[wallyinnc]

Thanks supersprt.

Yep, I tried to have them run under Admin privileges. I can't use the instructions you referred to, they are running as startup programs, not from a shortcut.

How would I configure htem to run automatically under my username and password?

I am now seriously consider to just disable them. After I set them to run under Admin, everything is much slower . . . I don't think it is a coincidence

 

[sup3rsprt]

First you make the task and shortcut as detailed in the tutorial. Use your username and password as credentials. Then you can put that shortcut in your kids start menu "Startup" folder.

You will want to disable the non-admin versions from starting. You can use a tool called Autoruns for that.

Autoruns for Windows

 

[sup3rsprt]

Hey Walter I think maybe I'm wrong about that, sorry.

If you mean creating elevated shortcuts for programs, then the only way a non-administrator account can run them is to provide the administrator's password when prompted by UAC. Otherwise a Standard or Guest account will not be able to run anything that requires UAC permission to run as administrator.

Hope this helps,
Shawn

 

[wallyinnc]

Thanks supersprt for continuing to look into it. +10! (I "+repped" you the other day, it won't let me do it again, but you deserve)!
Per Shawn's info I am stuck with the present behavior of UAC. I am downloading Autoruns and will play with it a little anyway. If nothing else it will help disable them at startup. I will let you know if I get to anything. Tks

 

[Barman58]

Hi Wally,

The way to get around the admin problem at start-up is by use of the task scheduler.

Create a task to start the program at start-up for the standard user accounts, (I think you will need one for each ), using your credentials, and make sure you select run with highest credentials

Has got me out of similar problems in the past

 

[sup3rsprt]

Hi Barman, that's actually what we've been discussing. but it doesn't seem to work. You can create a scheduled task but when a standard user runs it he will be prompted by UAC for the administrator password.

See where I quoted Shawn 3 posts up.

 

[Barman58]

Oh - I have had it working - on earlier versions of 7 - are you getting the elevate prompt or just not working at all? and are all other start-ups for the program removed / disabled.

 

[sup3rsprt]

I'll have to try this again, because I just did it in Win XP and it works.

Maybe were I went wrong is trying to start the task during user logon instead of system startup.

 

[Barman58]

Thinking back that could have been the case with my instance - unless they (MS) have closed the loophole in the RTM

 

[sup3rsprt]

Still not working for me in Win7. Maybe I'm just slow...

The UAC disable trick only works if I make a task as an administrator and run it using administrator credentials. I think that is all the trick was designed to do...stop the UAC prompt while you're an admin.

Since XP is able to start processes as a different user I'm beginning to think this is a bug in Windows 7. I did get about 2 or 3 strange errors along the way. Even a null pointer reference :huh:

 

[wallyinnc]

Hi Wally,

The way to get around the admin problem at start-up is by use of the task scheduler.

Create a task to start the program at start-up for the standard user accounts, (I think you will need one for each ), using your credentials, and make sure you select run with highest credentials

Has got me out of similar problems in the past

Thanks Nigel, and sorry for the delay. Busy day today.
I ended up reverting the whole ownership and " Run as Admin" settings, it made my computer slower overall.
Do you guys recommend I try the task scheduling you suggested, given SS's situation? I am running RC 7100.
Tks

 

[Barman58]

I think that this "trick" needs more research.

Theoretically if the task is set up to run the application as the admin user with the correct password and with the highest credentials - it should run without the elevation prompt

If the task is then set to run at the login of another user the access level of the user should not matter

This is I'm sure what used to happen with the "AT" command which the command underneath the task scheduler GUI, Obviously there is the now extra step of the UAC.

Will try to find an app that has the issue and try various task set-ups, though not sure when time will be available - there is also the issue of apps that are written pre UAC and those which are UAC aware - will these behave differently

It may be that this is an oversight, (OK Bug! ), on Microsoft's part - if so I can see this causing major issues in the enterprise where this requirement is a common one

 

[wallyinnc]

It worked (kinda)

I somehow got it to work. I am not sure how; if the problem was that the tasks were not actually running at all or if they needed to run under Admin privilieges.

First, they were not in Startup, they were Scheduled Tasks to run at log on. They were showing at Scheduled Tasks for the Standard users. I tried to have them run under the Admin account, with highest privileges, didn't work.

Then I went into the Admin, Scheduled Tasks and noticed they had errors, they apparenlty had not run. I then chenged to run under the Admin with highest privilieges, now they are running and they do not pop up anymore at the Standard User log on.

All in all it was a solution. I don't know if applicable in the cases where the task is running normally and UAC is asking for permission under a Standard User, maybe...

Thanks Nigel, thanks SS
10-3

 

[sup3rsprt]

Yes I think that much did work for me before. but the problem I had was creating a task for a standard user such that it would run with administrative credentials without the Admin ever having to log in.

Did you manage to get the process run with admin credentials after you reboot and log in as a standard user? Ultimately, I think you want it so you never have to log in. When your kids log in, the process should be started under your admin credentials.

 

[wallyinnc]

Hi SS
Yes, that is how it is working