VMware Horizon Community
TomH201110141
Enthusiast
Enthusiast

Priviledge Elevation works but does not execute the Logon-Task

I have a weird problem with the OSOT-Tool and I try to solve the problem now with DEM.

Background of my problem is that users are not able to set their wallpaper. The reason for this is a interfering registry value called "Wallpaper". I need to delete this value.

The key is here in  "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" and I try to delete this with an elevated task.

Elevation itself works. I can proof it by running a cmd with admin-rights.

This is my configuration:

TomH201110141_0-1620744188702.png

TomH201110141_1-1620744257833.png

And this the Debug-Log:

[INFO ] Successfully launched elevated task 'Delete Registry-Key'.

The problem is, that the Key doesn't get deleted. I don't know why because I don't see an error. Executing the complete string manually to delete key works but not by DEM.

I also tried setting any key with the help of this nice demo (https://www.vjal.nl/dynamic-environment-manager/using-the-new-elevated-task-feature-in-dem-to-manage...). This does not work either, although I do not see any error.

I assume that the Task doesn't get executed because I have set in "Global Configuration" that a Message has to appear for the test-user. But this message does not appear.

The message only appears when I try to start the CMD (as path-based elevation process) manually.

 

Reply
0 Kudos
6 Replies
DEMdev
VMware Employee
VMware Employee

Hi @TomH201110141,

I can't tell from your screenshot, so: in the definition of the Elevated Task, do you have Also elevate child processes checked? That would be required, as otherwise only that CMD.exe will be elevated; its child process REG.exe won't be...

BTW, as REG.exe is a standalone executable, you don't even need to launch it via CMD.exe. I just tested it with the following settings:

DEMdev_0-1620746850745.png

I created a logon task to launch it, and that worked correctly. I'd previously created that policy setting and verified that that registry value existed, and it was gone after logon.

Reply
0 Kudos
TomH201110141
Enthusiast
Enthusiast

Yes, Also elevate child processes is checked.

And yes you are right I can only use reg.exe as standalone process for this task - my fault. But that does not work either. Like I said, normally I should see a confirmation dialogue but this doesn't appear.

Reply
0 Kudos
DEMdev
VMware Employee
VMware Employee

Hi @TomH201110141,

Elevated tasks don't display the optional Ask user to elevate confirmation message, so that's OK.

If you launch the elevated task manually in the session (FlexEngine.exe -LaunchTask "name of your elevated task"), does it work? If not, could you collect a ProcMon trace to see what seems to be going on?

Reply
0 Kudos
TomH201110141
Enthusiast
Enthusiast

I did a manually run of the demo (setting a reg-key). But it did not work.

How can I send you the trace (I don't want to pase it here)?

Reply
0 Kudos
DEMdev
VMware Employee
VMware Employee

Hi @TomH201110141,

Maybe you can send me a private message with a DropBox/OneDrive/etc link?

Reply
0 Kudos
TomH201110141
Enthusiast
Enthusiast

You got a link. I hope the trace was correct in this way.

Thank you!

Reply
0 Kudos