Update: UltraVNC 1.4.3.6 and UltraVNC SC 1.4.3.6: viewtopic.php?t=37885
Important: Please update to latest version before to create a reply, a topic or an issue: viewtopic.php?t=37864

Join us on social networks and share our announcements:
- Website: https://uvnc.com/
- GitHub: https://github.com/ultravnc
- Mastodon: https://mastodon.social/@ultravnc
- Facebook: https://www.facebook.com/ultravnc1
- X/Twitter: https://twitter.com/ultravnc1
- Reddit community: https://www.reddit.com/r/ultravnc
- OpenHub: https://openhub.net/p/ultravnc

UAC - how to interact with UAC or disable it? [Solved]

Simple, Free, Open Source UltraVNC Wrapper Supporting Windows and Mac OSX
Post Reply
gumbo
8
8
Posts: 11
Joined: 2011-01-28 22:09

UAC - how to interact with UAC or disable it? [Solved]

Post by gumbo »

Scenario - A non-admin user on Windows 7 PC with UAC enabled needs an application to be installed.

Step 1. - The user follows instructions to download and run InstantSupport.exe. They run it, give me the 6 digit code and this allows me to connect and control their desktop.

Step 2. - If I right click on the tray icon and select disable UAC - the user sees a UAC prompt asking for administrator credentials. Sadly we cannot give the user these details.

Step 3. - The same for the tray option to Install as Service - user needs administrator account details to type in.


My question is - If I can connect and control after Step 1 plus I know the administrator details, is there no way for me to interact with or disable UAC myself without giving the user the administrator details and asking them to type them in?

I have seen a "logmein rescue" session where a non-admin user visited the logmein site, entered the 6 digit code and the the admin was able to connect in and control those UAC prompts some how. There must be a way to do this...

ChunkVNC is fantastic as-is but would be absolutely perfect if it was possible to get around UAC somehow without any user intervention. What do you think?
Last edited by gumbo on 2011-02-05 05:21, edited 3 times in total.
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

Re: UAC - how to interact with UAC or disable it?

Post by supercoe »

This is how UAC works.

Since InstantSupport is running as a user process it doesn't have permission to control anything on the secure desktop (services, uac prompts).

In order to control the secure desktop InstantSupport must be installed as a service via the tray menu. This will prompt for admin credentials to make the necessary registry changes.

I'll see if I can automate this by having you enter the admin username and password and having InstantSupport pass this info to the operating system. I'm not sure if this will work, we'll see.
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
gumbo
8
8
Posts: 11
Joined: 2011-01-28 22:09

Re: UAC - how to interact with UAC or disable it?

Post by gumbo »

Hello supercoe. Thanks for confirming this. I will download the source code and take a look at implementing this myself also.
gumbo
8
8
Posts: 11
Joined: 2011-01-28 22:09

Re: UAC - how to interact with UAC or disable it?

Post by gumbo »

Just doing a small bit of testing and the the Systernals tool "psexec" looks like it may be able to work around the issue.
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

Re: UAC - how to interact with UAC or disable it?

Post by supercoe »

Or just impliment RunAs in AutoIT. :)
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
gumbo
8
8
Posts: 11
Joined: 2011-01-28 22:09

Re: UAC - how to interact with UAC or disable it?

Post by gumbo »

Good find there :)
gumbo
8
8
Posts: 11
Joined: 2011-01-28 22:09

Re: UAC - how to interact with UAC or disable it?

Post by gumbo »

It works! Pretty simple actually but yes, finally I can take control of a non-admin user and control UAC prompts without them typing anything. Honestly, this now rivals "LogMeIn Rescue" easily!


The solution is to give popups (standard VNC controllable popups) for the admin username/password when the tray option to "install as service" is selected, then install the service with these credentials.

I originally tried running the "disable UAC" option as the admin user however it only disables it for the admin user you run it as, not the non-admin user you are trying to help so that avenue was no good.

Here is the rough and ready code fix - you will have to roll your own until supercoe can integrate this into 3.3 ;)

Code: Select all

;Edit at around line 317 - comment out the original code that installs the service 
;and instead prompt for admin credentials and install the service:

				;If IsAdmin() Then

				;	ShellExecute($WorkingPath & "\InstantSupport.exe", "-installservice", @ScriptDir, "")

				;Else

				;	ShellExecute($WorkingPath & "\InstantSupport.exe", "-installservice", @ScriptDir, "runas")

				;EndIf
				$domain = InputBox( "Admin Right Required", "Enter Domain Name or Hostname if Local Account", "" )
				$username = InputBox( "Admin Right Required", "Enter Administrator Username", "administrator" )
				$password = InputBox( "Admin Right Required", "Enter Password", "", "*" )
				if RunAs($username, $domain, $password, 0, $WorkingPath & "\InstantSupportVNC.exe -install") = 0 Then
					MsgBox (0, "Error Installing Service", "Error Installing Service!")
				EndIf


; - Edit around line 427 - Do not remove temp files as the uvnc_service will install from the temp directory
; and you need the config files for the service. Just comment out the If $DeleteFiles:

; Remove temp files.
;If $DeleteFiles = True Then _DeleteSelf( $WorkingPath, 5)




Bugs and further work required:
i) When service is installed, ensure it is installed named "chunkvnc" instead of uvnc_service and overwriting other vnc services that may be there.
ii) Need to make a nice way for you to remove the service once finished (In the mean time you can open up a cmd as the administrator and type "sc delete uvnc_service" then stop the service..)
iii) Need to copy the InstantSupportVNC.exe and the .ini files from the $WorkingPath to some other common path when installing the service and allow the $WorkingPath to be deleted.
Last edited by gumbo on 2011-02-05 05:24, edited 4 times in total.
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

Re: UAC - how to interact with UAC or disable it? [Solved]

Post by supercoe »

Great stuff :)
This is exactly what I was thinking, mad props! :D
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
JonD
40
40
Posts: 121
Joined: 2006-12-24 16:46
Location: Canada

Re: UAC - how to interact with UAC or disable it? [Solved]

Post by JonD »

This sounds like a great mod.. except I can't seem to get it working.

"Failed to open service control manager"

is the error message on a Vista 32 and Win7 64 machine.
What did I miss?


Both machines are in the MSHOME work group and I entered administrator credentials.

JonD
gumbo
8
8
Posts: 11
Joined: 2011-01-28 22:09

Re: UAC - how to interact with UAC or disable it? [Solved]

Post by gumbo »

JonD wrote:This sounds like a great mod.. except I can't seem to get it working.

"Failed to open service control manager"

is the error message on a Vista 32 and Win7 64 machine.
What did I miss?


Both machines are in the MSHOME work group and I entered administrator credentials.

JonD
If it's a workgroup then
i) first enable the local administrator account and give it a password
ii) As it is not a domain, get the computer hostname
iii) Run chunkvnc and run the install as service option. Enter the "hostname" for the domain followed by the administrator and finally the password (must not be blank).

That should do the trick. I've tested this on Vista business 64 bit, Windows 7 Ultimate 64 bit...
JonD
40
40
Posts: 121
Joined: 2006-12-24 16:46
Location: Canada

Re: UAC - how to interact with UAC or disable it? [Solved]

Post by JonD »

Using the "real" administrator account works...

I had disabled that account and was using an account with admin privileges. Not sure that I understand why that would not have worked.

Thanks for the help.

JonD
JonD
40
40
Posts: 121
Joined: 2006-12-24 16:46
Location: Canada

Re: UAC - how to interact with UAC or disable it? [Solved]

Post by JonD »

One other question...

Is there a reason you didn't use:
if RunAs($username, $domain, $password, 0, $WorkingPath & "\InstantSupport.exe -installservice") = 0 Then


I tried and it seems to be OK and preserves the previous functionality for uninstalling etc.

JonD
JonD
40
40
Posts: 121
Joined: 2006-12-24 16:46
Location: Canada

Re: UAC - how to interact with UAC or disable it? [Solved]

Post by JonD »

Another small tweak
- add @ComputerName
to
$domain = InputBox( "Admin Right Required", "Enter Domain Name or Hostname if Local Account", @ComputerName )

Obviously it's not always correct if you're involved with a domain but it does help for other cases where you don't have the computer name handy.

I also installed a secondary tray item... I now have 2 Install Service menu items. The first points at the old code to handle the case where the Administrator account is not enabled. The second uses this new option.

It all seems to work very well on my test computers.

Thanks Gumbo for a great addition to an already great utility.

JonD
Last edited by JonD on 2011-02-08 02:24, edited 1 time in total.
gumbo
8
8
Posts: 11
Joined: 2011-01-28 22:09

Re: UAC - how to interact with UAC or disable it? [Solved]

Post by gumbo »

Thanks JonD, they are look like nice extra tweaks. You are correct - I should have used "-installservice" instead of just "-install". And the tip about shortcut to the hostname is a good one too. AutoIT is actually very handy!

supercoe, would you consider integrating this into your next release?
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

Re: UAC - how to interact with UAC or disable it? [Solved]

Post by supercoe »

Working on adding this functionality to 3.3 as we speak. :D
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
Post Reply