UAC not functioning as expected

[khgiese]

My apologies if this is not the correct forum for this question/issue.

We have several Windows 7 professional systems. Most of them function as expected, however we have a few that do not.

Case in point:
We have two windows 7 pro 32bit systems that have the same identical setups, same patches etc (in thought anyway).

For this purpose we will call them PC-A and PC-B

Both Systems have UAC set to level 2.

Logged into PC-A as a user a member of the local administrator group.
When we try to install a .msi file on PC-A from a network share on one system, about half way through the install the UAC prompts us to allow a portion of the install to continue. after clicking continue the install completes.

Logged into PC-B as user, a member of the local administrator group.
When we try to install the same exact file as we did on PC-A, about the same point that PC-A prompts with UAC, PC-B fails with a message saying you need to run the install in evelated permission and the install fails.

Why are these two work stations displaying two different reactions to like situations?

It appears as though PC-B is not getting the flip to prompt for elevated permissions. If we cancel the eleveated permission prompt on PC-A, we get the same display message that PC-B defaults to, saying you need to run this with administrator privledges and fails the install.

We have been banging our heads trying to figure out why some (about 10%) have this issue.

Any help would be greatly appreciated.

Thanks,

 

[Brink]

Hello Khgiese, and welcome to Seven Forums.

I'm not sure why it may be doing that, but you might use the tutorial below to add "Run as administrator" to the context menu of MSI files. Afterwards, right click on the MSI file and click on "Run as administrator" to see if it will install now.

http://www.sevenforums.com/tutorials/158118-run-administrator-add-msi-file-context-menu.html

Hope this helps,
Shawn

 

[Julio Cortez]

It looks strange to me, very strange. Are you sure that both the users have administrator status on the respective machines?

If the .msi is the same, the OS is the same and you are sure that UAC on both PCs is set the same, the difference may be either in the user profiless (e.g. one is admin, the other isn't) or in the local security policies. You may want to have a look at those (in secpol.msc) and see if they really match on both the PCs

 

[khgiese]

Hello Khgiese, and welcome to Seven Forums.

I'm not sure why it may be doing that, but you might use the tutorial below to add "Run as administrator" to the context menu of MSI files. Afterwards, right click on the MSI file and click on "Run as administrator" to see if it will install now.

http://www.sevenforums.com/tutorials/158118-run-administrator-add-msi-file-context-menu.html

Hope this helps,
Shawn

Thanks for the suggestion, we had this in our pool of options.
Changing the registry on the affected machine is an option for a work around of the issue, but it don't resolve the issue.

 

[khgiese]

It looks strange to me, very strange. Are you sure that both the users have administrator status on the respective machines?

If the .msi is the same, the OS is the same and you are sure that UAC on both PCs is set the same, the difference may be either in the user profiless (e.g. one is admin, the other isn't) or in the local security policies. You may want to have a look at those (in secpol.msc) and see if they really match on both the PCs

Any suggestion to what area of secpol.msc I look at?
I have been through the User Rights Assignment and Security Options and fail to find a difference.

Thanks,

 

[Julio Cortez]

I guess this should be handy:

To change the elevation prompt behavior for administrators

1. Click Start, click Accessories, click Run, type secpol.msc in the Open box, and then click OK.
2. From the Local Security Settings console tree, click Local Policies, and then Security Options.
3. Scroll down to and double-click User Account Control: Behavior of the elevation prompt for administrators.
4. From the drop-down menu, select one of the following settings:
   • Elevate without prompting (tasks requesting elevation will automatically run as elevated without prompting the administrator)
   • Prompt for credentials (this setting requires user name and password input before an application or task will run as elevated)
   • Prompt for consent (default setting for administrators)
5. Click OK.
6. Close the Local Security Settings window.

The original article can be found here:
User Account Control Step-by-Step Guide

Hope it helps!

*edit*
Still, this makes no mention of the "automatically denying the elevation" case you report.
I'm still convinced that for some reason the user doesn't have the right permissions to start with. Have you perhaps tried with another administrative account, on the machine giving trouble?

 

[khgiese]

I guess this should be handy:

To change the elevation prompt behavior for administrators

1. Click Start, click Accessories, click Run, type secpol.msc in the Open box, and then click OK.
2. From the Local Security Settings console tree, click Local Policies, and then Security Options.
3. Scroll down to and double-click User Account Control: Behavior of the elevation prompt for administrators.
4. From the drop-down menu, select one of the following settings:
   • Elevate without prompting (tasks requesting elevation will automatically run as elevated without prompting the administrator)
   • Prompt for credentials (this setting requires user name and password input before an application or task will run as elevated)
   • Prompt for consent (default setting for administrators)
5. Click OK.
6. Close the Local Security Settings window.

The original article can be found here:
User Account Control Step-by-Step Guide

Hope it helps!

*edit*
Still, this makes no mention of the "automatically denying the elevation" case you report.
I'm still convinced that for some reason the user doesn't have the right permissions to start with. Have you perhaps tried with another administrative account, on the machine giving trouble?

We have tried using a domain admin account on the PC that does not prompt and we get the same results of fail to elevate.

We have tried removing the user from Local administrators group and readding them, no joy.

Going through Secpol.msc Local Policies, Security Options, there is no "User AccountControl: Behavior of the elevation prompt of administrators"
Here is was I see:
User Account Control: Behaviour of the evelation prompt for administrators in the Admin Approval Mode
and
User Account Control: Behavior of elevation prompt for standard users

On the PC this works and on pc this does not work on, The first is set to "Prompt for consent for non-windows binaries"
The second is set to "Prompt for credentials"
No difference in settings.

 

[Julio Cortez]

Damn... It might well be something that goes beyond my understandment (which will not be hard at all, honestly ) then.

I don't think I can help further, sorry. I hope someone more experienced than me can fix this for you