Privilege elevation in DEM 2009

[Octaviusse]

Hi all,

I'm trying to upgrade from UEM 9.3 to DEM 2009, for that i built a new image with

-Windows 10 1809

-Horizon View agent 10.1

-DEM Agent 2009

-App Volumes 2012

On the new image, i run the latest OSOT and disable the UAC.

My problem is that the privilege elevation is not working even if it's apply, and i'm still getting the UAC prompt.

Is there any special configuration to do in the image ? Or something to look at to know the real issue ?

Thanks

[DEMdev]

Hi @Octaviusse,

DEM's privilege elevation pretty much depends on UAC. Why do you disable it?

[Octaviusse]

Thanks for reply, I've tried with all the level of the UAC, from the lower to higher with no succes.

I've even tried to build a new environment for DEM 2009 with no succes.

Just want to add that with our production environment it's working fine (Windows 10 LTSB 1607, Horizon 7.10.1, UEM 9.3, App Volumes 2.18.1 and optimized with an old version of OSOT)

I'm really confused with that problem, any advice please?

[Octaviusse]

I've made another test image but without optimizing with OSOT and the privilege elevation work fine, now remain to find the related registry key related to this behavior. do you think that osot disable something related to the UAC ?

[DEMdev]

Hi @Octaviusse,

I'm not sure; I vaguely recall something from a few years ago where an OSOT change to some UAC-related setting was causing issues with privilege elevation.

Can you compare the various User Account Control settings in Local Security Policy (secpol.msc | Security Settings | Local Policies | Security Options) on the working and non-working systems?

[sjesse]

If you still have the OSOT that you used, check and see in the templates tab to see what it does, the newer ones have this

which is under the enable UAC setting

It may be worthwhile running the new osot against your image to see if it fixes it, but make sure you take a snapshot and test, since some of the older ones had different quirks you may have workaround.

[sjesse]

And there are other keys in that section too that the new tool modifies, that may be related

[Octaviusse]

Hi @DEMdev 

I've unchecked all related with UAC in the OSOT template, now i have the same settings in Secpol.msc (UAC) as the production one, but still privilege elevation does'nt work

[Octaviusse]

Hi @sjesse 

Thanks for the reply, i've already try to uncheck these modification, and still the same behaviour, 

For my production environement the image was build in 2017 and optimized with the VDILIKEAPRO template, but now i think it's not compatible anymore

[zenmatrix]

You can't just uncheck them, when you check them they run actions that do something, which means it was already done. You need to revert the actual changes which takes some work, you need to see what they did and manually change them

[Octaviusse]

hi @zenmatrix 

You're right, i always start the optimization from a fresh snapshot witch is not optimized.

[MIWE-Admins]

Does this option only work in the Horizon environment?

We only use the DEM on physical computers with Windows 10 1909 / 20H2 and I have these problems too.

[Octaviusse]

@MIWE-Admins it should also work with the physical desktop

My issue is solved with the latest version of DEM 2103.

Many thanks for all of you.

[DEMdev]

Sorry, @MIWE-Admins, I missed your question initially...

Just like pretty much all DEM functionality, privilege elevation works just fine on physical devices as well.