File Synchronization and UAC on Windows 7 / Windows 8
I suspect this question will apply to more than just File Synchronization, but the same concept will apply all across.
Up until I started playing with Windows 8, I've always had UAC turned off in my organization, and controlled security via other means. (GPO, Firewall, etc...) , so KACE deployments were not an issue.
However, with the upcoming Windows 8, in case you don't know, Microsoft made it so that none of the Live Tiles (or Metro Apps) function without UAC being at least set at the minimum level. With that, I decided to try to cope with that, and make things work around UAC. However, File Synchronization seems to completely fail with an "Access Denied" message when trying to copy something to, say, C:\Users\Public\Desktop.
Even when I try to perform the copy manually, from C:\ProgramData\Dell\Kace\Downloads\####\File.exe to C:\Users\Public\Desktop, the same "Access Denied" error appears. When running the same with an elevated Command Prompt, the copy works. If I turn off UAC, I suspect the KACE copy job will work. however, I'm thinking, that with Windows 8 on the horizon, and if some companies want to keep functionality to Metro apps available, they will undoubtedly have to keep UAC turned on, thereby crippling a lot of KACE's functions.
Am I missing something here? Can KACE handle UAC in such situations? and if so, how do I do that?
At this point, I'm attempting a very simple File Synchronization which takes a file associated with a software item, and places it on the C:\Users\Public\Desktop
Suggestions welcome...
Answers (1)
UAC shouldn't affect KACE operation once the agent has been installed.
I haven't used Win8 much, but it looks like Windows Defender is a lot more active. You might try excluding the K1000 in it to see if that makes a difference.
Comments:
-
Thanks for your response. Actually, I don't believe it affects the KACE agent per se, however, when the KACE agent triggers a process on the workstation (via, say, an offline script), that is no longer the KACE agent working, but the script itself, and this is where UAC can impede the function.
You mentioned something about Exclusions... is this in relation to UAC? I've never seen a place where you can create safe programs, etc ... (that would be awfully nice to have though!
By the way, the issue with UAC and the KACE script is pretty much fact, as I've tried the same File Synchronization operation (with no changes to the task). When UAC is on, even at minimum level, the task fails, and the log shows an 'Access Denied' message. as soon as I turn off UAC, the task runs with no issues.... - gkhairallah 12 years ago-
I'd say to do the following:
Enable debug and run the file sync.
Get screenshots of the errors.
Create a Kace support ticket so it can be looked into. - jknox 12 years ago-
Thanks. I've actually enabled debug the first time around. That's where I got the "access denied message". I guess I can submit it to KACE Support, though I'd suspect that they're going to tell me that UAC Is stopping it, so you need to disable that :) ...
I'll give it a shot though. - gkhairallah 12 years ago
-
Some other questions:
Were you giving it credentials for the location? Specifically a local admin?
Have you tried changing the compatibility level of the executables: http://blogs.msdn.com/b/cjacks/archive/2007/02/08/shimming-legacy-control-panel-applet-run-levels-in-windows-vista.aspx - jknox 12 years ago -
Thanks for this article, I'm going to try to download the compatibility administrator. This blog article seems to refer to cpl entries though. The file I'm trying to install has no compatibility issues, as it's just an compiled kix script into an exe which I wrote. I'll give it a shot to see if that works as well.
btw. off topic, is there a way to enable notifications of replies to posts on IT Ninja? ... I only happen to see the posts when I check the activity on my account. (that's why it's taking me a while to respond here.. my apologies) - gkhairallah 12 years ago
