Disable UAC for specified programs

[Sheridan]

We've got some oldish applicationd from Denford, for a milling machine and they were working OK before we upgraded to W10. Now every time they're run by a non-admin user they get the yellow UAC prompt to enter their credentials to continue (see image)

 

If they enter their (non admin) credentials then the program starts OK - its unsigned so I assume that's the problem. Is there any way to stop UAC from nagging for these apps, there's only a couple anyway and it seems impossible and probably unwise to disable UAC completely.

[pete]

(Assuming you've got an inhouse CA and have already setup code signing certs for things like SCCM / powershell scripts)

 

You could try signing the executable with a certificate linked to the inhouse CA that the computer already trusts. We had to do that for a couple of things that were allegedly mission critical but the companies responsible had gone under.

 

First result on quick-and-dirty Google search that'll get you started:

 

https://support.spirion.com/hc/en-us/articles/115000019391-Signing-an-Edited-Windows-Installer-package-msi-file-

 

Ignore that it mentions an MSI file - it'll work for all executables.

[Sheridan]

(Assuming you've got an inhouse CA and have already setup code signing certs for things like SCCM / powershell scripts)You could try signing the executable with a certificate linked to the inhouse CA that the computer already trusts. We had to do that for a couple of things that were allegedly mission critical but the companies responsible had gone under.First result on quick-and-dirty Google search that'll get you started:https://support.spirion.com/hc/en-us/articles/115000019391-Signing-an-Edited-Windows-Installer-package-msi-file-Ignore that it mentions an MSI file - it'll work for all executables.

Cheers, I'll have a try with that, its only a couple of crusty old programs. Oddly the suppliers (Denford) say they're compatible with W10, but as usual that means 'at home, single administrator user'

[Arthur]

I'm 99.9% sure Pete's suggestion will only change the appearance of the UAC dialog box (from yellow to blue). It won't get rid of it completely.

 

 

To force your app(s) to run as a standard user you need to create a 'shim' (a.k.a. Application Fix) with the Compatibility Administrator program that's part of Microsoft's Application Compatibility Toolkit (in the Windows ADK).

 

With the RunAsInvoker compatibility fix, users won't be prompted for admin credentials after the .sdb file containing the fix has been installed on their computers.

 

I had to do this for an old piece of software our tech department use.

 

 

See the following blog post for some basic instructions on what to do, but if you get stuck let us know.

 

https://blogs.technet.microsoft.com/askperf/2010/08/27/act-suppressing-elevation-prompts-for-legacy-applications

 

 

 

 

 

To silently install or uninstall the fix, the commands you need are as follows...

 

Install

C:\Windows\System32\sdbinst.exe -q "X:\Path\To\Fix.sdb"

 

Uninstall

C:\Windows\System32\sdbinst.exe -q -u "X:\Path\To\Fix.sdb"

 

Another method is to create an external manifest for the EXE that does the same thing as the application fix above, but if the EXE contains an internal manifest this will override the external manifest.

[pete]

@Arthur's probably right - I'm thinking of driver signing.

[Sheridan]

Ah right, I haven't tried yet. I'm not bothered if they had to click 'Yes' to proceed but they actually are asked to authenticate - so they can enter their password or specify alternative credentials. If they enter their own password it works so I'm sure why it even asks for credentials anyway!

[Arthur]

I'm not bothered if they had to click 'Yes' to proceed but they actually are asked to authenticate

The RunAsInvoker fix above will get rid of the authentication box completely.

[Sheridan]

@Arthur - that worked a treat, thank you for the detailed info! I'd tried the compatibility toolkit a few years ago with something else and didn't have much luck. I updated the ADK and went through it again and they run without any prompts!

[Arthur]

that worked a treat

Excellent news! Glad to hear it worked.

[2097]

Just found this post after having the same problem with visualizer software called "Lite array"

 

Worked great and was able to add it to the installation bat. A Lot ! better than using an encrypted VBE which invokes the "Run as" command.

 

Many thanks !