Windows 10: How to Install Applications with Elevated Privileges in Standard User Session via Windows...

Hi everyone,I'm building a lightweight Windows MDM Mobile Device Management solution, and I’m facing a critical issue regarding app installations in a standard user session from a Windows service running as SYSTEM.---The Problem:I want to remotely install applications silently some requiring elevation on user machines. My service runs in Session 0 as SYSTEM and:Executes PowerShell scripts or scheduled tasks for installations.Scripts and tasks complete successfully but do not install the app in the currently logged-in user session.No user interaction or visible installation happens in the

:)

 

UAC & standard users with additional privileges

I am marking this problem as solved. The problem was:

Allow a standard user to enable/disable a network without having to enter a password every time.

My solution for Windows 7 was:

1. Add the standard user to the "Network Configuration Operators" group.
2. Login as the standard user.
3. Create a shortcut to the network adapter.
4. Right-click on the shortcut to see or change the state of the network adapter.

I have received many useful and instructive suggestions on Tenforums. Based on those suggestions,
here's my solution for Windows 10:

1. Add the standard user to the "Network Configuration Operators" group.
2. Login as the standard user.
3. In a cmd window, run this command
netsh interface show interface
to learn the name of the network adapter.
4. Run Task Scheduler using the password of the standard user.
5. Create two shortcuts in accordance with Option 2 in this tutorial:
Elevated Shortcut without UAC - TenForumsTutorials
-- at Step 3, name the shortcuts something like “EnableLAN” and “DisableLAN”
-- at Step 7, in the Program/script field, type netsh
-- at Step 8, into the Add arguments field, type
interface set interface "name of network adapter" admin=enable
(Make the last element “disable” for the second task.)
-- at Step 14, name the shortcuts something like “Turn LAN On” and “Turn LAN Off”
6. Press the Win + R keys to open the Run dialog, type ncpa.cpl into Run, and click OK to open the Network Connections window. Keep this window open on your desktop to see the state of the network adapter. The color of the icon reflects the state of the adapter.
7. Click on one or the other of the two newly-created shortcuts to change the state of the network adapter. A cmd window briefly flashes on the screen. This can be eliminated using the procedure mentioned by Try3 in a previous post, if desired.

The solution for Windows 10 is much more cumbersome than the solution for Windows 7. I have to stop using Windows 7 due to the end of Microsoft support, and this is not the first time that I find Windows 10 to be less user friendly than Windows 7.

Thanks, again, to all who have kindly given me help and advice

 

Elevated Privileges

What program?

Elevated Privileges in Windows 8 / 7

How to grant or get Elevated Privileges in Windows 11

Ways to Grant Elevated Privileges In Windows

http://www.windowsecurity.com/artic...y/ways-grant-elevated-privileges-windows.html

 

Scheduled tasks run with elevated privileges can't access stored Windows credentials

It seems that after Creators update scheduled tasks run with elevated privileges ('run with highest privileges' option) can't access stored Windows credentials. Is that a bug or an intentional change and is there a recommended workaround?

Here's one way to reproduce the behaviour:

• Start Credential Manger and add some Windows share credentials.
• In a console window type 'cmdkey /list', which should list the added credentials
• Create a task in a task manager:
  • Trigger: on user logon
  • Action: run cmd.exe
  • Tick the 'run with highest privileges' option
• Reboot the machine and log in
• In the console window (let's call it 'console 1') opened from the scheduled task type 'cmdkey /list'. This most likely won't display the credentials added in step 1 and properly listed in step 2. ->
  This looks like a bug
• Now, without closing 'console 1' open another console window as an administrator (let's call it 'console 2') and type 'cmdkey /list'. This will properly list credentials added in step 1.
• Switch to 'console 1' and type 'cmdkey /list' again. This time the credentials are listed properly, unlike in step 5. It looks like an access to Windows credentials was somehow 'unlocked' by step 6.