Octaviusse
Enthusiast
Enthusiast

Privilege elevation in DEM 2009

Hi all,

I'm trying to upgrade from UEM 9.3 to DEM 2009, for that i built a new image with

-Windows 10 1809

-Horizon View agent 10.1

-DEM Agent 2009

-App Volumes 2012

On the new image, i run the latest OSOT and disable the UAC.

My problem is that the privilege elevation is not working even if it's apply, and i'm still getting the UAC prompt.

Is there any special configuration to do in the image ? Or something to look at to know the real issue ?

Thanks

0 Kudos
13 Replies
DEMdev
VMware Employee
VMware Employee

Hi @Octaviusse,

DEM's privilege elevation pretty much depends on UAC. Why do you disable it?

0 Kudos
Octaviusse
Enthusiast
Enthusiast

Thanks for reply, I've tried with all the level of the UAC, from the lower to higher with no succes.

I've even tried to build a new environment for DEM 2009 with no succes.

Just want to add that with our production environment it's working fine (Windows 10 LTSB 1607, Horizon 7.10.1, UEM 9.3, App Volumes 2.18.1 and optimized with an old version of OSOT)

I'm really confused with that problem, any advice please?

0 Kudos
Octaviusse
Enthusiast
Enthusiast

I've made another test image but without optimizing with OSOT and the privilege elevation work fine, now remain to find the related registry key related to this behavior. do you think that osot disable something related to the UAC ?

0 Kudos
DEMdev
VMware Employee
VMware Employee

Hi @Octaviusse,

I'm not sure; I vaguely recall something from a few years ago where an OSOT change to some UAC-related setting was causing issues with privilege elevation.

Can you compare the various User Account Control settings in Local Security Policy (secpol.msc | Security Settings | Local Policies | Security Options) on the working and non-working systems?

0 Kudos
sjesse
Leadership
Leadership

If you still have the OSOT that you used, check and see in the templates tab to see what it does, the newer ones have this

 

sjesse_0-1615060426727.png

 

which is under the enable UAC setting

 

sjesse_1-1615060465124.png

 

It may be worthwhile running the new osot against your image to see if it fixes it, but make sure you take a snapshot and test, since some of the older ones had different quirks you may have workaround.

0 Kudos
sjesse
Leadership
Leadership

And there are other keys in that section too that the new tool modifies, that may be related

 

sjesse_0-1615060648719.png

 

0 Kudos
Octaviusse
Enthusiast
Enthusiast

Hi @DEMdev 

I've unchecked all related with UAC in the OSOT template, now i have the same settings in Secpol.msc (UAC) as the production one, but still privilege elevation does'nt work

0 Kudos
Octaviusse
Enthusiast
Enthusiast

Hi @sjesse 

Thanks for the reply, i've already try to uncheck these modification, and still the same behaviour, 

For my production environement the image was build in 2017 and optimized with the VDILIKEAPRO template, but now i think it's not compatible anymore

Tags (1)
0 Kudos
zenmatrix
Contributor
Contributor

You can't just uncheck them, when you check them they run actions that do something, which means it was already done. You need to revert the actual changes which takes some work, you need to see what they did and manually change them

0 Kudos
Octaviusse
Enthusiast
Enthusiast

hi @zenmatrix 

You're right, i always start the optimization from a fresh snapshot witch is not optimized.

0 Kudos
MIWE-Admins
Contributor
Contributor

Does this option only work in the Horizon environment?

We only use the DEM on physical computers with Windows 10 1909 / 20H2 and I have these problems too.

0 Kudos
Octaviusse
Enthusiast
Enthusiast

@MIWE-Admins it should also work with the physical desktop

My issue is solved with the latest version of DEM 2103.

Many thanks for all of you.

0 Kudos
DEMdev
VMware Employee
VMware Employee

Sorry, @MIWE-Admins, I missed your question initially...

Just like pretty much all DEM functionality, privilege elevation works just fine on physical devices as well.

0 Kudos