UAC - how to interact with UAC or disable it? [Solved]

[gumbo]

Scenario - A non-admin user on Windows 7 PC with UAC enabled needs an application to be installed.

Step 1. - The user follows instructions to download and run InstantSupport.exe. They run it, give me the 6 digit code and this allows me to connect and control their desktop.

Step 2. - If I right click on the tray icon and select disable UAC - the user sees a UAC prompt asking for administrator credentials. Sadly we cannot give the user these details.

Step 3. - The same for the tray option to Install as Service - user needs administrator account details to type in.


My question is - If I can connect and control after Step 1 plus I know the administrator details, is there no way for me to interact with or disable UAC myself without giving the user the administrator details and asking them to type them in?

I have seen a "logmein rescue" session where a non-admin user visited the logmein site, entered the 6 digit code and the the admin was able to connect in and control those UAC prompts some how. There must be a way to do this...

ChunkVNC is fantastic as-is but would be absolutely perfect if it was possible to get around UAC somehow without any user intervention. What do you think?

[supercoe]

This is how UAC works.

Since InstantSupport is running as a user process it doesn't have permission to control anything on the secure desktop (services, uac prompts).

In order to control the secure desktop InstantSupport must be installed as a service via the tray menu. This will prompt for admin credentials to make the necessary registry changes.

I'll see if I can automate this by having you enter the admin username and password and having InstantSupport pass this info to the operating system. I'm not sure if this will work, we'll see.

[gumbo]

Hello supercoe. Thanks for confirming this. I will download the source code and take a look at implementing this myself also.

[gumbo]

Just doing a small bit of testing and the the Systernals tool "psexec" looks like it may be able to work around the issue.

[supercoe]

Or just impliment RunAs in AutoIT.

[gumbo]

Good find there

[gumbo]

It works! Pretty simple actually but yes, finally I can take control of a non-admin user and control UAC prompts without them typing anything. Honestly, this now rivals "LogMeIn Rescue" easily!


The solution is to give popups (standard VNC controllable popups) for the admin username/password when the tray option to "install as service" is selected, then install the service with these credentials.

I originally tried running the "disable UAC" option as the admin user however it only disables it for the admin user you run it as, not the non-admin user you are trying to help so that avenue was no good.

Here is the rough and ready code fix - you will have to roll your own until supercoe can integrate this into 3.3

Code: Select all

;Edit at around line 317 - comment out the original code that installs the service 
;and instead prompt for admin credentials and install the service:

				;If IsAdmin() Then

				;	ShellExecute($WorkingPath & "\InstantSupport.exe", "-installservice", @ScriptDir, "")

				;Else

				;	ShellExecute($WorkingPath & "\InstantSupport.exe", "-installservice", @ScriptDir, "runas")

				;EndIf
				$domain = InputBox( "Admin Right Required", "Enter Domain Name or Hostname if Local Account", "" )
				$username = InputBox( "Admin Right Required", "Enter Administrator Username", "administrator" )
				$password = InputBox( "Admin Right Required", "Enter Password", "", "*" )
				if RunAs($username, $domain, $password, 0, $WorkingPath & "\InstantSupportVNC.exe -install") = 0 Then
					MsgBox (0, "Error Installing Service", "Error Installing Service!")
				EndIf


; - Edit around line 427 - Do not remove temp files as the uvnc_service will install from the temp directory
; and you need the config files for the service. Just comment out the If $DeleteFiles:

; Remove temp files.
;If $DeleteFiles = True Then _DeleteSelf( $WorkingPath, 5)

Bugs and further work required:
i) When service is installed, ensure it is installed named "chunkvnc" instead of uvnc_service and overwriting other vnc services that may be there.
ii) Need to make a nice way for you to remove the service once finished (In the mean time you can open up a cmd as the administrator and type "sc delete uvnc_service" then stop the service..)
iii) Need to copy the InstantSupportVNC.exe and the .ini files from the $WorkingPath to some other common path when installing the service and allow the $WorkingPath to be deleted.

[supercoe]

Great stuff
This is exactly what I was thinking, mad props!

[JonD]

This sounds like a great mod.. except I can't seem to get it working.

"Failed to open service control manager"

is the error message on a Vista 32 and Win7 64 machine.
What did I miss?


Both machines are in the MSHOME work group and I entered administrator credentials.

JonD

[gumbo]

This sounds like a great mod.. except I can't seem to get it working.

"Failed to open service control manager"

is the error message on a Vista 32 and Win7 64 machine.
What did I miss?


Both machines are in the MSHOME work group and I entered administrator credentials.

JonD

If it's a workgroup then
i) first enable the local administrator account and give it a password
ii) As it is not a domain, get the computer hostname
iii) Run chunkvnc and run the install as service option. Enter the "hostname" for the domain followed by the administrator and finally the password (must not be blank).

That should do the trick. I've tested this on Vista business 64 bit, Windows 7 Ultimate 64 bit...

[JonD]

Using the "real" administrator account works...

I had disabled that account and was using an account with admin privileges. Not sure that I understand why that would not have worked.

Thanks for the help.

JonD

[JonD]

One other question...

Is there a reason you didn't use:
if RunAs($username, $domain, $password, 0, $WorkingPath & "\InstantSupport.exe -installservice") = 0 Then


I tried and it seems to be OK and preserves the previous functionality for uninstalling etc.

JonD

[JonD]

Another small tweak
- add @ComputerName
to
$domain = InputBox( "Admin Right Required", "Enter Domain Name or Hostname if Local Account", @ComputerName )

Obviously it's not always correct if you're involved with a domain but it does help for other cases where you don't have the computer name handy.

I also installed a secondary tray item... I now have 2 Install Service menu items. The first points at the old code to handle the case where the Administrator account is not enabled. The second uses this new option.

It all seems to work very well on my test computers.

Thanks Gumbo for a great addition to an already great utility.

JonD

[gumbo]

Thanks JonD, they are look like nice extra tweaks. You are correct - I should have used "-installservice" instead of just "-install". And the tip about shortcut to the hostname is a good one too. AutoIT is actually very handy!

supercoe, would you consider integrating this into your next release?

[supercoe]

Working on adding this functionality to 3.3 as we speak.