How would I go about finding out why a program needs UAC permissions and allowing it?

[Garacesh]

Now we all know UAC (annoyingly...) doesn't have a whitelist option. We've asked for it, and Microsoft gave us the LALALALALALALA treatment.

 

We run a piece of software here that hooks into data from SIMS and, according to our staff (I don't really touch it) it's a powerful tool for progress monitoring and the like. The problem is, the guys that wrote it coded it a bit on the naff side. You host a server that runs things like a SQL database etc, and all your clients hook into that. Now, standard practice says that your server downloads updates and your client pulls them from your server (thus, being an internal resource and 'safe'), right?. Well the guys that wrote this software decided against that. Each client annoyingly downloads updates (individually, not cached anywhere) from the internet and applies them. UAC, as you can imagine, takes issue with this.

 

The program has a Launcher.exe that checks for updates and if it finds any, downloads them to and runs them from %TEMP%, so that's a folder that the currently logged on user has full permissions on. I've tried changing the permissions of the software's C:\Program Files (x86) folder to include full control to staff users, but we're still getting UAC prompts. Our staff aren't local admins, so this means every time there's an update we have to go to every machine where it's used and authorise the update. Only takes 20 seconds per machine but it sure adds up.

 

Any idea how I'd go about tracking down what it's trying to do exactly and putting something in place to allow it to get done? I've tried telling the programmers to write it properly but so far there's been no change as to how it works.

 

Do you want to allow this app to make changes to your PC?

Program name: $Name

Verified Publisher: $Publisher

File origin: Hard Drive on this computer

Program Location: "C:\Program Files (x86)\$Program\Apply.exe" -Files "C:\Users\%USERNAME%\AppData\Local\Temp\3.4.7.* -App "C:\Program Files (x86)\$Program\Launcher.exe -pwd "$Password" -unzipDir "C:\Program Files (x86)\$Program"

* This trails off beyond the boundaries of the UAC prompt window.

[sted]

if you have a terminal server publish it as a remote app so you only have 1 to update?

[Steve21]

4Matrix by any chance? If so it's just the 4Matrix folder in PF we give them access to and updates work fine for us.

 

Steve

[Arthur]

The 'Standard User Analyzer' program included in Microsoft's Application Compatibility Toolkit (which itself is part of the latest Windows 10 ADK) should help.

[bald_pig]

Ahh, you beat me to it Steve! Just add modify permission for the 4matrix folder

[Garacesh]

if you have a terminal server publish it as a remote app so you only have 1 to update?

That was my first idea, since we have some apps running from an application server already. It didn't like it

I don't know what you mean by terminal server, though O.o We push the msi out via GPO

 

4Matrix by any chance? If so it's just the 4Matrix folder in PF we give them access to and updates work fine for us.

Ahh, you beat me to it Steve! Just add modify permission for the 4matrix folder

Lol, well what do you know, I guess it has a reputation

 

Yep, that's the one. And yes @Steve21/@bald_pig, I gave our staff group Full Control over the Program Files (x86)\4Matrix folder but that hasn't worked

Edited May 26, 2016 by Garacesh

[DJ-1701]

If I want to see what a program is doing, or changing, I usually use Process Monitor https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx and refine what I am looking for or a program that tracks changes on the hard drive and registry between two points in time (like the free version of Total Uninstall - Version 2 I believe).

[bald_pig]

Saying that, I've never seen it give a UAC prompt, just access denied when the update tries to copy the files.

[Garacesh]

Saying that, I've never seen it give a UAC prompt, just access denied when the update tries to copy the files.

 

Well you can turn UAC off in policy, maybe that's why you don't see it?

But for us, staff aren't local admins, so the UAC prompt asks for credentials to elevate. That's why I thought it might be permissions-based and tried giving staff full control of the folder, but that hasn't worked.

[Garacesh]

I usually use Process Monitor https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

I'm guessing RegSetInfoKey means it's trying to modify a registry value? Which explains requiring permission elevation..

[DJ-1701]

If it is a local machine one, quite possibly yes.

 

Could change the branch permissions and give it a go.

[Steve21]

Yep, that's the one. And yes @Steve21/@bald_pig, I gave our staff group Full Control over the Program Files (x86)\4Matrix folder but that hasn't worked

 

All we have is Modify Permissions on the folder via %ProgramFiles%\4Matrix which is what it does update the folder. The temp is just where it downloads to so nothing is run there.

 

What are your settings within the launcher settings?

 

We use:

 

CheckForUpdates - True

CopyLocal - False

CopyLocalPath - Blank

CustomTempFolder - Blank

DebugMode - False

DownloadUpdates - True

OverrideTempFolder - False

UnzipUpdatesToSubfolder - False

UseShellExecute - Default

UseVerbRunAs - Default

 

What's the actual error you guys get when it's run? If you deny the UAC elevate? As shouldn't ask for any admin rights if they have full control (take it it's on the actual 4matrix folder too?)

 

Steve

[Garacesh]

If it is a local machine one, quite possibly yes.

HKCR\ so that'd be a yes on the local machine reg.

Edit: Yep, HKLM\ further down, too.

 

All we have is Modify Permissions on the folder via %ProgramFiles%\4Matrix which is what it does update the folder. The temp is just where it downloads to so nothing is run there.

 

What are your settings within the launcher settings?

 

We use: [snip]

What's the actual error you guys get when it's run? If you deny the UAC elevate? As shouldn't ask for any admin rights if they have full control (take it it's on the actual 4matrix folder too?)

 

Brand new install, launch 4Matrix (via Launcher.exe), finds updates.. Downloading 1 of 5.. 2 of 5.. etcetera. Then after 5/5, UAC prompt bearing the info in the OP. If I cancel I get Failed to run updates: The operation was cancelled by the user. and then There was an error applying updates, 4Matrix will now close

 

We don't have a launcher settings file here - I do remember using one a while back to try and debug the issue when I was talking with their reps but it never got anywhere. Do you mind giving me the full name and location of the file and I'll try your settings, see if that works in conjunction with NTFS permissions?

Edited May 26, 2016 by Garacesh

[lostsoul]

The 'Standard User Analyzer' program included in Microsoft's Application Compatibility Toolkit (which itself is part of the latest Windows 10 ADK) should help.

 

I've used this in the past, works well.

[DJ-1701]

HKCR\ so that'd be a yes on the local machine reg.

 

Actually HKCR is an mix of both HKLM\Software\Classes and HKCU\Software\Classes. I believe in this case if it can not write to HKLM it would write to HKCU.

[Steve21]

Dumb question, but when you say you gave them permissions did you also give permissions to the person who's doing the upgrades? You'd have set this when doing the Network manager install

 

Steve

[Garacesh]

Dumb question, but when you say you gave them permissions did you also give permissions to the person who's doing the upgrades? You'd have set this when doing the Network manager install

The Program Files (x86)\4Matrix folder has 'Full Control' (for testing, would narrow it down after it started working) given to our Staff group in AD.

As for the network manager, we originally assumed that the network manager would have a service for installing updates, so we created a service account for it that, which Group Policy sets as a local admin of the machine. But that turned out to not work.

[Steve21]

The Run Update As user needs to have access to write to the C:\ drive on the local machines.

 

This is the account it'll use to write unless the user has direct access too.

 

Also put this file (it's the default one) within a 4Matrix folder and try it again: http://www.4matrix.com/files/downloads/rm/LauncherSettings.xml

 

Steve

[bald_pig]

Well you can turn UAC off in policy, maybe that's why you don't see it?

But for us, staff aren't local admins, so the UAC prompt asks for credentials to elevate. That's why I thought it might be permissions-based and tried giving staff full control of the folder, but that hasn't worked.

 

Nope, UAC is enabled, we're not that mad!

[Garacesh]

Also put this file (it's the default one) within a 4Matrix folder and try it again: http://www.4matrix.com/files/downloads/rm/LauncherSettings.xml

Ah, I managed to figure out how to make the 4Matrix Network Manager generate its own Launcher file (same settings as yours, by default) which then gets copied as part of the GPO msi install.

This LauncherSettings.xml and giving Staff Modify permissions has had no effect. Still asking for UAC creds.

 

Worth noting, I have changed the password of the service account just to be sure that it's correct. Run Update As: is set as domain.local\serviceaccount and I've ensured the password is correct. That being said, clicking 'Show Details' on the uac prompt the -pwd switch hasn't changed. I don't actually know if what it's displaying was the old service account password or not, though. I've uninstalled 4Matrix and used the 'Re-Copy Files' option in the Network Manager, but this hasn't updated the 4MClient.msi (still shows as being created some time last year)

 

Nope, UAC is enabled, we're not that mad!

No, no.. I don't mean disable UAC, just have UAC prompts disabled (I.E. if a machine would request elevated permissions, it disregards the request as if the user had clicked 'Cancel', 'No', etc)

[bald_pig]

No, no.. I don't mean disable UAC, just have UAC prompts disabled (I.E. if a machine would request elevated permissions, it disregards the request as if the user had clicked 'Cancel', 'No', etc)

 

Nope, they're enabled.

[Steve21]

When you say it's showing the old MSI is that within the server? or the path you're putting the MSI in (Set within the Manager tool)?

 

Steve

[Garacesh]

I've turned on Debug mode and ran the launcher again..

 

 

• CheckForUpdates - Proxy Set
  
• CheckForUpdates - Result Found
  
• It then takes considerably longer to download each of the 5 updates, but doesn't give any messages for this so I don't know why.
  
• Running as
  
  Domain: $domain.local
  
  
  Username: $ServiceAccount

  
  

• Failed to run as $ServiceAccount
  
  The Process object must have the UseShellExecute property set to false in order to start a process as a user.

  
  

 

Alright, let's change that value from 'Default' to 'false' then..

 

• CheckForUpdates - Proxy Set
  
• CheckForUpdates - Result Found
  
• It then takes considerably longer to download each of the 5 updates, but doesn't give any messages for this so I don't know why.
  
• Running as
  
  Domain: $domain.local
  
  
  Username: $ServiceAccount

  
  

• There was an error applying an update: Access is denied.
  

 

Access denied to what exactly? Group Policy sets the service account as part of the BUILTIN\Administrators group! The service account should be allowed to do whatever it feels like! >.<

 

 

Edit:

When you say it's showing the old MSI is that within the server? or the path you're putting the MSI in (Set within the Manager tool)?

@Steve21, Yes, the MSI created by the 4Matrix Network Manager (4Matrix Network Manager, Folders, Client Setup Folder:) Edited May 26, 2016 by Garacesh

[Steve21]

Take it you haven't got the service account blocked under SRP etc?

 

Maybe try logging on locally as the service account and test it on one?

 

Steve

[Garacesh]

Take it you haven't got the service account blocked under SRP etc?

 

I.. don't think so? SRP settings are applied to the user that logs on, and the 4Matrix Network Manager has been fed details of a service account that exists in a different OU, thus doesn't have SRP applied to it. Besides, SRP is set to Apply software restriction policies to the following users: All users except local administrators, and the service account is part of the local administrators (BUILTIN\Administrators) group, I just checked with lusrmgr.msc and that policy is being applied.

 

I'm not really sure what else to check.

 

I moved the service account out of 'Managed Service Accounts' into a different OU to ensure no policy is being applied (for some reason I can't see the default OU's (Computers etc) in Group Policy Management) and it still hasn't worked.

 

Really stumped now.