Sibelius Licence Check Out

[Jamo]

Hellooo all!

Anyone had a look at the new licence servers for Sibelius? They offer a check out service where a member of staff can effectively use the network licence at home for a predetermined period of time.

Looks like a great feature, however when checking out a licence a UAC prompt appears which is writing some registry key in HKLM? Anyone come across this and found a workaround without an admin having to dismiss the prompt each time the teacher wants to take Sibelius home?

[british_government]

We dont have this issue, we have quite lenient access policies for staff laptops, try and find the sibelius keys in the registry and grant access to staff, should at least help with the problem

[Jamo]

We dont have this issue, we have quite lenient access policies for staff laptops, try and find the sibelius keys in the registry and grant access to staff, should at least help with the problem

That was my thought, looked using Procmon and sibelius writes SO MUCH constantly its actually mad!

[rh91uk]

Just found this too, will be using it for our new MacBookPros

[Jamo]

Yeah nice feature, interesting implementation though!!

Documentation on it is sparse the say the least! From what I can see RegTool.exe which does the licencing requires 'elevation'. Prehaps they took their coding skills from those at SIMS.

[british_government]

I will see if I can get my hands on one of our staff laptops later and work out the access rights on them and post back. To be honest I have a feeling users are local administrators on the laptops. Anybody tried disabling UAC?

[Jamo]

I refuse to give up on UAC now I spent so long getting SIMS to update cleanly!! lol

Yeah I did a ProcMon capture of all the events and have given all users full rights to the HKLM\Software\Avid keys, hopefully will be successful soon!!

[british_government]

I refuse to give up on UAC now I spent so long getting SIMS to update cleanly!! lol

I was just thinking as a troubleshooting step

[Jamo]

Right

Managed to get around the hurdles in the following way for those who are interested:

We have staff as 'Users' of the laptops so no admin rights etc. The Regtool.exe which sibelius uses to check out the licence requires elevation and no amount of prodding will get it to run without.

To allow staff users to run the tool you can create a scheduled task which runs 'on demand' with the 'run with highest privileges' ticked. Ensure that the task will run as the 'Group' which staff members belong to in our case Domain\Staff.

The tasks action is just set to run the Sibelius EXE.

To allow staff to run the task browse to C:\Windows\System32\Tasks\*NameOfTask* and change the security permissions of the task file to Domain\Staff to read and execute.



The shortcut to the Sibelius exe can then be changed to:
schtasks.exe /run /TN "Launch Sibelius"

That will then allow the users to check licences in and out

[Benji2665]

To allow staff users to run the tool you can create a scheduled task which runs 'on demand' with the 'run with highest privileges' ticked. Ensure that the task will run as the 'Group' which staff members belong to in our case Domain\Staff.

The tasks action is just set to run the Sibelius EXE.

To allow staff to run the task browse to C:\Windows\System32\Tasks\*NameOfTask* and change the security permissions of the task file to Domain\Staff to read and execute.



The shortcut to the Sibelius exe can then be changed to:
schtasks.exe /run /TN "Launch Sibelius"

That will then allow the users to check licences in and out

Hi,

Great to see someone else with the same problem, we have students using it and are only standard users. We've tried your suggestion but we're still getting the elevation prompt. Are there any other permissions that need changing?

Ben

[Jamo]

Hi,

Great to see someone else with the same problem, we have students using it and are only standard users. We've tried your suggestion but we're still getting the elevation prompt. Are there any other permissions that need changing?

Ben

This is my install file Install.bat: (Run as Admin)

echo Copying the Sibelius Sounds to D: (For Teacher Laptops)...
REM xcopy "%~dp0Sibelius Sounds\*.*" "D:\Avid\Sibelius Sounds\*.*" /y /E




echo Creating Registry Entry...
reg ADD "HKLM\SOFTWARE\AVID\Sibelius Sounds\Sibelius 7 Sounds\ContentPath" /ve /t REG_SZ /d "D:\Avid\Sibelius Sounds\Sibelius 7 Sounds" /f




echo Creating Scheduled Task for Licence Check Out/In.
schtasks /create /XML "\\server\packages$\Avid\Sibelius 7.1.2\Launch Sibelius.xml" /TN "Launch Sibelius"


echo Allowing Task to be Run By Domain\Staff
icacls "C:\Windows\System32\Tasks\Launch Sibelius" /grant Domain\StaffRX)


echo Allowing Access to Registry to Domain\Staff
Powershell.exe -File "\\server\packages$\Avid\Sibelius 7.1.2\ChangeReg.ps1"




echo Allowing Access to Program Files to Domain\Staff
icacls "C:\Program Files\Avid" /grant Domain\StaffOI)(CI)F


echo Done.

The Changereg PS1 file is:

$acl = Get-Acl HKLM:\SOFTWARE\Avid
$rule = New-Object System.Security.AccessControl.RegistryAccessRule ("Domain\Staff","FullControl","ContainerInherit"," None","Allow")
$acl.SetAccessRule($rule)
$acl | Set-Acl -Path HKLM:\SOFTWARE\Avid

The Scheduled task XML is: (Launch Sibelius.xml)

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Date>2012-09-27T15:27:31.1852617</Date>
<Author>Domain\MyUsername</Author>
</RegistrationInfo>
<Triggers />
<Principals>
<Principal id="Author">
<GroupId>Domain\Staff</GroupId>
<RunLevel>HighestAvailable</RunLevel>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>false</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
<UseUnifiedSchedulingEngine>false</UseUnifiedSchedulingEngine>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
<Priority>4</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"C:\Program Files\Avid\Sibelius 7\Sibelius.exe"</Command>
</Exec>
</Actions>
</Task>

Those are the files I use to install and the scheduled task runs the sibelius exe. This is done for staff only, the students run the standard way as they don't check the licence out.

[Jamo]

O dear Edugeek has decided that some of the permissions from iCacls are sad faces! lol

It does explain how I felt discovering this though!!!

If you need more help I can stick the files up on my website.

[Steve21]

O dear Edugeek has decided that some of the permissions from iCacls are sad faces! lol

It does explain how I felt discovering this though!!!

If you need more help I can stick the files up on my website.

Use code tag, not quote (Just for future refererence)

 :( :) :D

Steve

[Jamo]

Use code tag, not quote (Just for future refererence)

 :( :) :D

Steve

Ah I need to Go Advanced!

:D

[Jamo]

Hi,

Great to see someone else with the same problem, we have students using it and are only standard users. We've tried your suggestion but we're still getting the elevation prompt. Are there any other permissions that need changing?

Ben

@Benji2665 just noticed you have to add a permission to the local PC to allow your staff users to elevate to near admin when the task runs.

Add the staff group or the group of staff required to run sibelius (and have checkout enabled) to the Computer/Windows Settings/Security Settings/Local Policies/User Rights Assignment/Impersonate Client After Authentication.

The checkout will then work for the group you specified in the policy above.