UAC and password protected hard drives

[CHiLL]

We have an issue with external hard drives that are password protected. When a user attempts to run the application to enter their password for the drive to unlock it...we get a UAC prompt stating that administrative credentials are required to perform this action. However, its not happening on all devices.

 

We have a hardware encrypted Freecom 2.5" external drive, which when connected shows a drive in Computer with an application called 'Password.exe' that is required be run to enter the password. When the executable is run, we get the UAC prompt.

We also have a hardware encrypted Kingston flash drive, which when connected shows a drive in Computer with an application called 'DTPlus.exe' that is required to be run to enter the password. When the executable is run, it asks for the password and away we go. No UAC prompt whatsoever.

 

When our domain admin accounts runs both of these drives, no UAC prompt is shown.

 

We have had an external engineer take a look at this and after a while, he stated that relaxing the UAC level would resolve the issue for the Freecom drive. Obviously UAC is there for a reason... what risks would we be opening if we disable UAC?

[3s-gtech]

If your permissions are correct, relaxing UAC would just mean that you'd just get an access denied or similar error. At least with the UAC prompt, it pops up to allow you to elevate your privileges. UAC isn't the problem as such, it's the permissions level of your users. I'd suggest that the Freecom drives won't really be suitable, but you may be able to wrap the application in a launcher which elevates its permissions on startup. This comes with its own caveats.

 

Have a look at How To Use The Task Scheduler To Launch Programs Without UAC Prompts

[Roberto]

UAC isn't the problem as such, it's the permissions level of your users.

 

So much this. UAC isn't the problem. It's a symptom. An external plug-in drive that requires admin access to work isn't suitable in this day and age. Simple as that.

[Oaktech]

I would be turning off the hardware encryption and enforcing bitlocker in this sort of environment

[CHiLL]

Hmm, OK. Thanks for the replies. Now to tell the member of staff they have to buy another drive!