Turning off UAC is no solution at all.
The problem is that one needs to run the application as administrator in order for it to communicate with the service, running as system. That will result in an apporval question by the system during logon.
The solution I found is based on creating a task per user to start the application manager during logon by that same user.
Offcourse, I do not want to run around and create tasks everywhere so I added a few things to my logon script to annoy local administrators once to create that specific task for them. And on every other system they logon to and happen to be local admin.
The other problem is that one cannot run the logonscript elevated, whatever you try. And I tried everything I think.
So here's my solution for the logon script:
- Check for local admin rights (pipeline whoami output and search for "\Administrators" should do the trick). Not local admin? No need to run Application Manager!
- Check for existance of the Aaplication Manager.
- Check for existance of a specific task. I'll get back to that one.
If all criteria are met, the logonscript will start another batch:
- Copy some files to %public% (or any other folder different users can access locally). These files include fragments of an XML file and a third batchfile.
- Assemble the fragments together with the user-ID to form an XML file
If the XML file is created the batchfile can be run elevated. Now the user has to approve, only once, on this machine!
- Start the local batchfile elevated, with nircmd for instance (www.nirsoft.net). User intervention required. No way around UAC.
- Remove the application manager from the windows startup sequence by removing an entry from the registry.
- Create a task based on the XML file.
- Start the task. Normally when the user logs on the task will be started automatically but since we just created it, we have to do it from the batch. This is the task mentioned earlier.
The result will be a task for the user who is local admin that will run only when user is logging on and without prompt. I guess only suitable for environments where every user has its own machine and has local admin rights.
