[DIS_UAC] and/or "request UAC on start"?

[lwc]

There are currently 4 ways to prepare Single Click:

1. Not requesting UAC on start and also not using [DIS_UAC]
2. Not requesting UAC on start but using [DIS_UAC]
3. Requesting UAC on start but without using [DIS_UAC]
4. Requesting UAC on start while also using [DIS_UAC]

Can you explain the differences?

Thanks!

[Rudi De Vos]

Using a manifest, we tell the OS that runas admin is required, requesting UAC on start.
This allow you to controle elevated system apps. But the user need to press the UAC allow each time

[DIS_UAC]
temp disable UAC for admin and reset it back on exit.
The disable require UAC once, but after that you don't need any user intervention to press the UAC popups.

[lwc]

Thanks, so you say [DIS_UAC] means if system apps are run, the UAC prompt for them will be only once.
Does this mean #3 will prompt on start plus every time you launch such an app?

But what's the difference between #2 and #4?
In #2 when will be this one time prompt?

[Rudi De Vos]

When you open an elevated app you get the UAC prompt
1) This run in a secure deskrop.
Because vnc is not running as service, using sc you can not press the UAC prompt and need to ask it to the user
2) Elevated apps can only b controled by other elevated apps


**If vnc doesn't run elevated you can not press the UAC popup and you can not control the elevated app, even after the user pressed the UAC OK. 1) and 2) are blocked

**Using the manifest, sc start elevated
1) Need to be done by the remote user each time it popup
2) is allowed

**Using [DIS_UAC] you actual temp disable UAC for admins (UAC setting)
To disable it the user need to press the popup once. If UAC is disabled you don't have 1) and 2)

[lwc]

I'm sorry, it's hard to understand. What is "the mainfest"?

Does [DIS_UAC] make SC run in admin mode?

As for the bullet points, can you help out which each of them:

1. Not requesting UAC on start and also not using [DIS_UAC] => What will happen here?
2. Not requesting UAC on start but using [DIS_UAC] => What will happen here?
3. Requesting UAC on start but without using [DIS_UAC] => What will happen here?
4. Requesting UAC on start while also using [DIS_UAC] => What will happen here?

[Rudi De Vos]

Not requesting UAC on start and also not using [DIS_UAC] => What will happen here?
You can only control normal apps
Not requesting UAC on start but using [DIS_UAC] => What will happen here?
You can control all apps and UAC is diabled
Requesting UAC on start but without using [DIS_UAC] => What will happen here?
You can control all apps, but you still get the UAC popup that require user intervention
Requesting UAC on start while also using [DIS_UAC] => What will happen here?
You can control all apps and UAC is diabled

Requestion UAC on start: only admins can start SC

Using [dis_uac], everybody can start sc , but natural only admins can change the uac setting, this option doesn't do anything
if you don't have permission to change it.

[lwc]

Not requesting UAC on start but using [DIS_UAC] => What will happen here?
You can control all apps and UAC is diabled
Requesting UAC on start while also using [DIS_UAC] => What will happen here?
You can control all apps and UAC is diabled

Alright, so both these options are identical, except the second one will produce an extra prompt.
Unfortunately, this prompt sounds unneeded and yet it's a mandatory part of May 2019 Update (the only version with SecureVNCPlugin).

Also, if the user answers "no" to this prompt, will this basically ignore [DIS_UAC]?

Unless you're saying without requesting UAC on start the user is expected to right click and choose "Run as Admin" even if [DIS_UAC] is used?