Windows 7 64b - requires elevation

[JonD]

I've successfully installed and run the service on some Windows 7 computers... however, today I ran into an issue with one computer.

This computer is part of a domain.
1. I had a user login in as a local admin (not domain account)
2. Did the usual connection
3. Selected install service
4. Got disconnected (as expected)
5. User responded to UAC with the admin credentials
6. Service install failed because task needed elevation.

I'm reasonably sure (we tried several times and the individual is a reliable sort) that everything was done correctly at his end.

I didn't try with UAC disabled.
I didn't try with the domain admin password as the individual does not have access to that password.

This procedure has worked well on other non-domain Windows 7 64b computers so I'm unclear as to why it failed. Any suggestions would be appreciated.

This machine has similar issues with running an .exe stored on the server as well so it may very well be nothing to do with ChunkVNC.

JonD

[supercoe]

Interesting...

I've had luck installing as a service while logged into a domain account as administrator and as the local admin but this was on XP and 2003 Server.

Being locally logged in as Administrator and it not working is the part I'm having problems figuring out....

What are the other problems you mention?

[JonD]

They have difficulties running an application where the .exe is stored in a folder on their server. Every time the individual needs to run the application UAC pops up wanting an admin set of credentials. The only thing that works is the server admin credentials.

I had the local IT person enter the credentials as the user does not personally have access to them. It does not 'store' the approval so the next time it asks again and again etc.

I switched him (the end user) to another XP machine and (of course) everything was no issue even though that was also a domain connected computer.

JonD

[JonD]

With respect to their running of programs off the server, I'm guessing the program tries to access/write to a folder on the local machine that is protected. In other words, it may not be he remote .exe as such.

This still doesn't explain the situation with ChunkVNC other than the fact that it is a Win 7 computer connected to a domain and only the domain admin credentials will allow the service installation... this is not the case for the XP machines. For the XP machines, I can use local admin credentials.

JonD

[JonD]

I wonder if Windows 7 allows different privileges for a "true" administrator account vs an account that is a member of "administrators"? In my problem case described above, the account used was "admin" and was simply a member of the administrators group.

JonD

[JonD]

The good news seems to be that using the credentials for the administrator account on Windows 7 (in the domain) works without issue.

Using credentials for a generic account that is a member of the administrator group did not work.

Please note that there was never an issue with a stand-alone Windows 7 64b computer using the generic account... it only seemed to surface as an issue for this one Windows 7 account that is in a domain.

Bottom line:
For the Windows 7 computer in a domain, there seems to be a difference between true administrator account and an account that belongs to administrators group.

I'll update this thread if I get any more info.

EDIT:
20100929: Another successful connection today using the full "administrator" local account (not the domain administrator and not the administrators group account).

JonD

[tbran6]

Domain Active Directory policies can be set to supersede local admin rights. My company does this. To see the applied AD policies, at the command prompt issue: "gpresult"
To pipe it to a file: "gpresult >FileName.log"

[supercoe]

Wow, great info. Thanks for the write up.