How would I go about finding out why a program needs UAC permissions and allowing it?

[Mike_Bostock]

If there are problems with UAC or similar when running 4Matrix, the following document should help provide the answer. http://www.4matrix.com/help/update_help.pdf

 

Do feel free to contact us directly for a speedy answer if you have any technical issues with 4Matrix.

[Garacesh]

Logged into Windows as the service account that the 4Matrix Network Manager has the details of..

 

• CheckForUpdates - Proxy Set
  
• CheckForUpdates - Result Found
  
• It still takes longer to download the updates than previously. Still don't know why, but it progresses, so no biggie.
  
• Running as
  
  Domain: $domain.local
  
  
  Username: $ServiceAccount

  
  

 

It then applies the update just fine, with no UAC prompt.

So I'm guessing the issue is that it thinks it's running as the service account, but it actually isn't? Or maybe my issue lies somewhere in policy, but I wouldn't know where to look..

Edited May 27, 2016 by Garacesh

[Garacesh]

Looking at the procmon results, I'm seeing lots and lots of SUCCESS, some NAME NOT FOUND, some FILE LOCKED WITH ONLY READERS, a few INVALID PARAMETER and END OF FILE, a lot more BUFFER OVERFLOW than I'm happy with (though, 1 buffer overflow is too many in my books..)

 

However I do also see 6 ACCESS DENIED, which are all RegOpenKey for HKLM\System\CurrentControlSet\Services\WinSock2\Parameters

 

 

Edit: Turns out I was using 3.3.something, so I upgraded to 3.5 since 3.3 is apparently incompatible with the launchersettings (never mind the fact that the launchersettings file is literally no different...)

 

Now 4Matrix complains there's no Settings file. The new version of the software didn't bother copying it from the client share when it installed. Neither did it copy the LauncherSettings.xml. Magical.

Okay, so copy that over manually to the local disk, I'll have to have a batch file do that as part of Startup I guess, but for now manual copying will do.

 

Now if I run Launcher.exe I don't get any error messages.. But it just sits there. Looping through 1 update(s) found, downloading update 1 of 1, checking for updates, 1 update(s) found, downloading update 1 of 1, over and over.

If I check C:\Users\%USERNAME%\AppData\Local\Temp, I can see it's downloading 3.5.4.0.exe (2,200KB) over and over, but it doesn't do anything with it. If I run 3.5.4.0.exe manually, it extracts (via 7-zip) without any credential request.

• 4Matrix.exe (14,611KB)
  
• Base.dll (35KB)
  
• BusinessLayer.dll (665KB)
  
• DataLayer.dll (6,819KB)
  

 

If I run the 4Matrix.exe manually, nothing appears to happen.

 

If I extract 3.5.4.0.exe to C:\Program Files (x86)\4Matrix and approve all 4 file overwrites, Launcher.exe no longer detects an update and then closes. 4Matrix does not launch after this. If I manually try to launch 4Matrix from 4Matrix.exe, nothing happens.

 

@Mike_Bostock, can you advise? The Staff group in AD have Modify/Write permissions on C:\Program Files (x86)\4Matrix, and the service account has full control (as well as being a member of the BUILTIN\Administrators group) yet the update still won't install.

Edited May 27, 2016 by Garacesh

[LinkZ]

I'm getting the exact same problem as you Garacesh, I thought I was going mad so i'm kind of glad it's not just me having this issue! If I turn off UAC then the update will run perfectly fine but with UAC on and a local admin user account set to run the updates in the settings file I can't make it go through as a normal user.

 

Very interested to find out the answer to this one.

[lostsoul]

Have a look at the standard user analyzer.

 

https://msdn.microsoft.com/en-us/library/windows/desktop/dd744768(v=vs.85).aspx

 

It will generate a file that you can apply to systems to allow single application to bypass UAC. I have used it multiple times, and it works great.

[Garacesh]

I'm getting the exact same problem as you Garacesh, I thought I was going mad so i'm kind of glad it's not just me having this issue! If I turn off UAC then the update will run perfectly fine but with UAC on and a local admin user account set to run the updates in the settings file I can't make it go through as a normal user.

 

Very interested to find out the answer to this one.

Well at least it isn't just me. If you turn on debug mode and run the 7-zip/exe manually (as staff, with UAC enabled) it works just fine, but when doing it via the 4Matrix launcher it requires credentials?

[LinkZ]

I don't see a UAC prompt due to the GPO settings I use, however if I disable UAC by changing the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA regkey to 0 the update will run fine.

 

My GPO UAC settings are

 

 

With debug mode on I get the following error when attempting to run the software update (SoftwareUpdater being the account with local administrator privileges that I have told 4Matrix to run all updates as)

 

 

Logging in as the SoftwareUpdater account on the computer and running 4Matrix results in the update running successfully.

Edited June 1, 2016 by LinkZ

[ChrisSmith]

Hi @Garacesh

 

Have you tried contacting our support team? I am the Development Manager at 4Matrix and would be more than happy to sort out your Permissions issue for you personally. Please call our helpline on 020 3475 4463 and ask to speak to me. We do see problems like this from time to time but can usually resolve them in just a few minutes via remote support.

 

You host a server that runs things like a SQL database etc, and all your clients hook into that. Now, standard practice says that your server downloads updates and your client pulls them from your server (thus, being an internal resource and 'safe'), right?. Well the guys that wrote this software decided against that. Each client annoyingly downloads updates (individually, not cached anywhere) from the internet and applies them. UAC, as you can imagine, takes issue with this.

 

You are correct that by DEFAULT, 4Matrix works by downloading updates to each pc individually but it is possible to change this to the method you mention above and I would be happy to help you set this up if you wish

 

The program has a Launcher.exe that checks for updates and if it finds any, downloads them to and runs them from %TEMP%, so that's a folder that the currently logged on user has full permissions on. I've tried changing the permissions of the software's C:\Program Files (x86) folder to include full control to staff users, but we're still getting UAC prompts. Our staff aren't local admins, so this means every time there's an update we have to go to every machine where it's used and authorise the update. Only takes 20 seconds per machine but it sure adds up.

 

Any idea how I'd go about tracking down what it's trying to do exactly and putting something in place to allow it to get done? I've tried telling the programmers to write it properly but so far there's been no change as to how it works.

 

I am sorry that you feel this software isnt written "Properly", I do not appear to have any emails from you suggesting changes are needed? It is working perfectly well in 100's of other schools, some of which have required our assistance but we are yet to find a school who cant get it working so look forward to resolving your issues.

[Garacesh]

You are correct that by DEFAULT, 4Matrix works by downloading updates to each pc individually but it is possible to change this to the method you mention above and I would be happy to help you set this up if you wish

 

[snip]

 

I am sorry that you feel this software isnt written "Properly", I do not appear to have any emails from you suggesting changes are needed? It is working perfectly well in 100's of other schools, some of which have required our assistance but we are yet to find a school who cant get it working so look forward to resolving your issues.

I've phoned you before, (maybe not you, personally, but 4Matrix Support certainly) and had one of your devs remote into my machine trying to figure it out and left scratching their head. Just like I have tested again recently, hoping things had changed, your dev discovered that the member of staff (well, staff test account, but same configuration) was able to apply the update themselves by running the 7zip .exe manually, yet the Launcher still required UAC permissions. This was left unresolved.

 

My remarks about your software not being written 'properly' are in regard to the Run Update As: clearly not working, and the software's default behaviour of each client downloading from the internet. It's fairly standardised for the software industry that if you need to run a server for a specific program, that server downloads the updates and your clients pull it from there. I can't see why you would have chosen not to have this behaviour by default. Again, this is a grievance I did air on the phone with whichever dev attempted to assist me previously.

Edited June 3, 2016 by Garacesh

[ChrisSmith]

I will be happy to resolve all your issues for you if you are able to give me a call

[ITGuyWestMidlands]

We use it here with no issues. Granted, the download from the Web for each and every client is a bit odd but it works. I'd try regenerating your setting file on the server as I'm guessing it's not pointing the launcher to the correct temp folder. Don't forget you can always just run it for everyone off a network share as an alternative and just give yourself permissions to update.

[Garacesh]

Don't forget you can always just run it for everyone off a network share as an alternative and just give yourself permissions to update.

Can you? I tried that here, installing 4Matrix to our application server, and it did not work.

[Garacesh]

Hm. So it appears the new version does play nice with being ran remotely. Previous versions we've had we tried installing to the application server and it wasn't having it.

 

(Bump because I can't edit my previous post)