Installing applications as an end user using admin login details

[SJ98]

Hi all,

 

We're a bit lost and need either guidance or someone who can point us in the right direction. We want to install applications on end user laptops/dekstops by double-clicking an application (while logged into the end user account) and typing in the administrator username and password for our domain instead of logging off of their account and using the domain admin account itself. We're not sure how to go about this, if someone could point us in the right direction?

 

Thanks,

Sam

[thimon]

If UAC is setup correctly the installation should automatically prompt for an admin's credentials, when signed in as a standard user. Does this not happen? If not it sounds Group Policy related.

[SJ98]

Hello,

No, that doesn't happen. It is set to just deny any installations.

Do you know what way UAC has to be set up for it to work in our intended way?

[Tom_P]

Depending on where the application is saved can you not hold shift - right click - run as different user and then input your domain administrator credentials?

[thimon]

This is the official documentation from Microsoft - https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings

 

It's up to you (depending on your role) / your school's IT Support / IT Leadership how they want it setup.

Edited May 17, 2022 by thimon

[SJ98]

Hi Tom,

Your suggestion wasn't available to me, I couldn't see an option that said to run as a different user.

[SJ98]

So I did find this, and what we're looking for is User Account Control: Detect application installations and prompt for elevation.

But after enabling the policy, I still don't think that it works.

[free780]

You can always right click and run as admin to force elevation.

 

Starting an admin cmd/PowerShell as admin can also have the same effect.

 

Not all installers respect UAC properly.

[SJ98]

Hello free780,

Sadly this doesn't seem to make a difference when your run as an admin, it just does the same thing as if you weren't an admin.

[strawberry]

Run CMD

Elevate to Admin

Navigate to the exe or msi and then run the exe, or use msiexec /i fliename.msi to run it.

Profit.

[thimon]

Create a seperate GPO with the relevant policies in place? gpupdate /result to ensure the policy is applying.

[chaplic]

I think you have a bunch of policies attempting to disable UAC, the side effect is you cannot elevate-at-will. You asked for advice, mine would be you are doing this completely wrong. Firstly the settings causing the issues you've described, but secondly why would you install software manually?

[CrootUK]

I think you have a bunch of policies attempting to disable UAC, the side effect is you cannot elevate-at-will. You asked for advice, mine would be you are doing this completely wrong. Firstly the settings causing the issues you've described, but secondly why would you install software manually?

 

Have to agree with this, sounds like a big security risk to me.

[SJ98]

Hi Chaplic,

I understand that I may have policies that are restricting me, which I am going through. To answer your second question, I haven't heard of anything that can deploy applications (exe for example) as an admin to end user machines, unless you are able to provide this solution? I would happily use something that lets me install applications as an admin, from my PC for example, if they're logged in as an end user.

[jthompson]

Running an installer exe locally and elevating to admin via a UAC prompt in order to get it done seems to me to be a perfectly reasonable thing to want to be able to do. Software is sometimes only needed by one or two users, at short notice and not easily deployed remotely. It's sometimes not even installing, just a run-once thing (e.g. GoToWebinar). It's one of the reasons UAC exists in the first place. I don't see why it would be a security risk.

 

I've a feeling that UAC left to its default settings might do what you want (i.e. kick in and prompt for administrator credentials whenever needed). You'll probably just need to do what you're already doing and work through the policies that you have in place in your environment to unpick things. In Group Policy, I believe all of the options linked to in an earlier post are in Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. They all begin with "User Account Control: ".

 

Run "gpresult -h results.htm && results.htm" (as an admin, funnily enough) on a client machine and see which GPOs any of those settings are coming from.

Edited May 18, 2022 by jthompson

[chaplic]

Things like go-to-webinar will run in the context of a unprivlaged user assuming you don't block random executables.

 

There are some software that absolutely cannot be automatically installed but these are very unusual, and in such a unsual use-case logging in as an admin wouldn't be a big deal. It's never just a single install is it, people switch PCs, get new ones, and so on. Packaging the app to suit your environment also helps capture knowledge about serial numbers and similar.

 

I'm assuming we dont have SCCM, but AD has the ability to push out MSIs baked into group policy.

 

If the app is an EXE it will usually have a silent install switch. We can use that to wrap it as an MSI, create an MSIX or use group policy to copy the files to a local machine and have a machine startup script install it.

[psydii]

Hi Chaplic,

I understand that I may have policies that are restricting me, which I am going through. To answer your second question, I haven't heard of anything that can deploy applications (exe for example) as an admin to end user machines, unless you are able to provide this solution? I would happily use something that lets me install applications as an admin, from my PC for example, if they're logged in as an end user.

 

SCCM can deploy per user, and so can GPOs. However I suspect this particular software is some janky exam-proctor or e-marking app and manual install is the only way to get it to work?

[srochford]

I don't know how many computers you have or how much you can spend but there are many systems available which will do what you want.

At the big end of the market is Microsoft Endpoint Configuration Manager (often referred to by its older name of SCCM) which does pretty much everything apart from making the tea. Cheaper but very useful is PDQ Deploy. Finally, Manage Engine have a free version of Desktop Central; it can manage up to 25 PCs. I've never used it but it looks good.

Google for Windows software deployment to find other systems.

 

Steve