carrela Absent Member.
Absent Member.
6383 views

Deploying with UAC enabled on Win7 client

Hi,

We want to enable the UAC on Windows 7 client. But I have problem deploying applications. We are in a AD domain.

How can I deploy applications in "Administrator UAC disabled mode" to not have problems ?

Thank you for your help

Alain
Labels (2)
0 Likes
16 Replies
Micro Focus Expert
Micro Focus Expert

Re: Deploying with UAC enabled on Win7 client

You can change the UAC settings globally.
It sounds like you would like it disabled for admins.
Look here:
http://computerperformance.co.uk/vista/user_account_control.htm

Also Pure MSIs Actions generally will not generate a prompt, due to
special hooks into the Windows Installer Service.

EXE and other actions, however, by UAC design will still generate prompts.



On 6/21/2011 9:36 AM, carrela wrote:
> "Administrator UAC disabled mode"



--
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner

Novell does not officially monitor these forums.

Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.
--
Please give a hearty thumbs up to any post you find helpful!
To find articles by Craig Wilson simply follow the link: Craig Wilson's Tips!
0 Likes
carrela Absent Member.
Absent Member.

Re: Deploying with UAC enabled on Win7 client

Hi,

I want to enabled the UAC but I want that when I install bundle I didn't have problem. All my users are local Administrator.

Is is possible to do something ?

Alain
0 Likes
pitcherj Absent Member.
Absent Member.

Re: Deploying with UAC enabled on Win7 client

carrela,

I'm not absolutely certain what you're asking for, but here are a couple of thoughts that your messages have provoked.

First, we have UAC enabled and haven't run in to any problems over here.

We deploy most applications as a dynamic administrator or using the SYSTEM account, and I don't believe I have seen a UAC prompt appear in the dynamic administrator userspace since it's technically (seen as) a session 0 account.

Second, any users who are administrators may encounter UAC prompts (just a simple yes/no) for unsigned executables or executables on network shares, but this can be cut off at the chase by either adding the local fileservers to the trusted sites on your workstations or by disabling zone checks (this would be a global thing, so it may be a security issue for you). What you could do in lieu of this is adding the SEE_MASK_NOZONECHECKS=1 environment variable on any ZENworks-launched executable. This should prevent UAC prompts from appearing.

Jacob
0 Likes
Highlighted
carrela Absent Member.
Absent Member.

Re: Deploying with UAC enabled on Win7 client

Hi,

Thank oyu for the answer. I'm not sure but "dynamic administrator" is not working on a Windows domain ? And SYSTEM account is also not working If installation sources files are located on a UNS share ?

I have seen that I'm unable to install an AutoIT application with UAC enable.
And I'm unable to install application that copy files on the C drive with UAC enabled.

Thank you

Alain
0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Deploying with UAC enabled on Win7 client

Dynamic Administrator should work just fine.

It's quite possible you have a Group Policy that blocks the creation of
Dynamic Administrator's.

I would not expect SYSTEM to have access to Network Shares.

You can copy the files locally using User Rights or better yet, make use
of the Content Repo.

I'm not sure why UAC would block access to the C: Drive.

On 6/27/2011 3:36 AM, carrela wrote:
>
> Hi,
>
> Thank oyu for the answer. I'm not sure but "dynamic administrator" is
> not working on a Windows domain ? And SYSTEM account is also not working
> If installation sources files are located on a UNS share ?
>
> I have seen that I'm unable to install an AutoIT application with UAC
> enable.
> And I'm unable to install application that copy files on the C drive
> with UAC enabled.
>
> Thank you
>
>



--
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner

Novell does not officially monitor these forums.

Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.
--
Please give a hearty thumbs up to any post you find helpful!
To find articles by Craig Wilson simply follow the link: Craig Wilson's Tips!
0 Likes
pitcherj Absent Member.
Absent Member.

Re: Deploying with UAC enabled on Win7 client

carrela,

Dynamic Administrator should work just fine.

The main issue is that it is operating under a separate user space from your currently logged in user(s), and thus (as of the release of Windows 2000) will not have access to mapped drives.

The way we handle this *sigh* is to copy the files locally using either a copy files action running under the currently logged in user, or by using some other file copy utility to display a bit more of a progress indication to the end user.

Once the files are local to the workstation (C:\Installs\softwarename or something similar) you can launch the installer from there using a launch executable or launch network MSI action.

We use a number of AutoIT scripts in our environment, and have had no problems with UAC enabled...

Jacob
0 Likes
carrela Absent Member.
Absent Member.

Re: Deploying with UAC enabled on Win7 client

Hi,

Ok but you have to copy the sourcesfiles first ?
Because I have approx. 80 bundles and some bundles are 4Gb big so it wil take a very long time to copy it locally before. And "Dynamic Admin" works only if we copy the files locally right ? Because in the help file, it is write that it doesn't work with Windows AD.

Alain
0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Deploying with UAC enabled on Win7 client

On 6/28/2011 5:36 AM, carrela wrote:
>
> Hi,
>
> Ok but you have to copy the sourcesfiles first ?
> Because I have approx. 80 bundles and some bundles are 4Gb big so it
> wil take a very long time to copy it locally before. And "Dynamic Admin"
> works only if we copy the files locally right ? Because in the help
> file, it is write that it doesn't work with Windows AD.
>
>

A Straight MSI install should work from a Share, since ZCM will elevate
rights through the Windows Installer Service Policies that are
dynamically enabled.

ZCM 11 SP1 may have some features to allow you to install as Dynamic
Admin directly from a share.


--
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner

Novell does not officially monitor these forums.

Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.
--
Please give a hearty thumbs up to any post you find helpful!
To find articles by Craig Wilson simply follow the link: Craig Wilson's Tips!
0 Likes
pitcherj Absent Member.
Absent Member.

Re: Deploying with UAC enabled on Win7 client

carrela,

Yep, I copy all of my source files first.

We've tried most every option we can think of, and it's the most reliable and the simplest (as far as being able to apply the same deployment methodology across the board).

Unfortunately, not every installer is a straight-up MSI. Also, you don't always want to re-package every application, because then it's your responsibility to support it, not the vendor's.

We have 600+ bundles and have made multiple passes through them all as we have changed methodologies several times.

You do have the option of uploading your large bundles to the repository, and then letting ZENworks handle deploying the files to your users in the background, but I prefer not to throw such huge items into the repository as it can take a very long time for it to compress and encrypt the files, plus, once you throw an item into the black box, the only way to modify it is to hang on to the source files and re-upload the entire thing if you want to make any changes.

You are correct about dynamic administrator working only if you copy the files locally, and I can tell you that we are an Active Directory environment and have had no problems with dynamic administrator accounts. All they are is a local account on the box that gets created/deleted on the fly by the ZENworks service (incidentally, this is why you see the "Interactive Services Detection" dialog when any installer with a UI is launched in the dynamic administrator space, because the ZENworks service is running as the SYSTEM account (session 0)).

Jacob
0 Likes
carrela Absent Member.
Absent Member.

Re: Deploying with UAC enabled on Win7 client

Hi,

Ok to resume the situation with UAC enabled :

- Migrate from ZCM 10 to ZCM11 because it doesn't work with ZCM10
- Modify all bundles, first action copy it locally, then launch the executable as Dynamic Administrator, then delete the source file.

Is it right ?
But copying source files that are 5GB will take a very very long time to be installed, no ?

Did you have an example for a bundle ? Office, Adobe, Cadence, Solidworks, or SAP ?

Thank you

Alain
0 Likes
pitcherj Absent Member.
Absent Member.

Re: Deploying with UAC enabled on Win7 client

carrela,

What doesn't work with ZCM10? That's the version we are running right now...

Yes, you'll need to modify all bundles as you describe.

We regularly deploy massive applications through this method copying from a mapped drive on the user's workstation (CS5.5, etc).

It all depends on your network speed.

We installed CS5.5 Design Premium on an HP 6200 small form factor as a test.

This includes:
Bridge
Device Central
Dreamweaver
ExtendScript Toolkit
Extension Manager
Fireworks
Flash Catalyst
Flash Professional
Illustrator
InDesign
Media Encoder
Photoshop
Pixel Bender Toolkit

Time spent copying files:
3 minutes, 5 seconds

Time spent installing the product:
20 minutes, 22 seconds

Total CS5.5 Install Time:
23 minutes, 27 seconds

Total installer size:
3.36 GB

Note that the average copy time for this machine was 18.59 Megabytes / Second.

This is because our testing lab is on a gigabit connection. If you are in a 100mbit connection, you'll obviously see a longer time on the file copy.

Workstation Specifications:

HP Compaq 6200 Pro SFF PC
CPU Speed: 3.3 GHz
Memory: 3072 MB
Intel 82579LM Gigabit Network Connection

Bundle Actions:
copy AAMEE deployment files from network drive to local disk
install network MSI action pointed at the deployment created with AAMEE
Install exceptions provided by AAMEE wizard
Delete install files

Jacob
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.