Note: This is a topic brought over from DameWare Forums which has been closed. If you wish to engage in this discussion, just comment on this document.
connecting to a vista pc it always requires users permission
by mmenzie on Sat Sep 15, 2007 9:29 am
Hello,
I have a couple of vista test machines on our network. they are not joined to our domain and are in there own local workgroup. by default vista diables the administrator acct. and i have leftit disabled. i created two users on the machines, one regular and one with admin privledges. when i try to use the MRC to connect to these machines it always asks the user if they are going to allow the connection even when i try to connect using the acct i created with admin rights. this cause me a lot of headaches cause since these are test machines there is usually no user sitting at them, so i have to go to the machine so i can allow the connection. i don't have tis issue connecting to any of my xp/2000/2003 pc's and servers. so what am i doing wrong????
Re: connecting to a vista pc it always requires users permission
by bryan on Mon Sep 17, 2007 11:00 am
Hi mmenzie,
Please provide us with some additional information so we can more intelligently assit you.
- Is this a Microsoft UAC (User Account Control) permission dialog? Or is this a Mini Remote Control "Waiting for Client to Accept Connection" permission dialog? Perhaps even send us ascreen shot of this dialog.
- Which version of the MRC software are you currently running?
- Which version of the MRC Client Agent Service is installed on the remote machine?
- Is the remote machine running a 64-bit version of Vista, or 32-bit?
- Also, which flavor of Vista are they running (Ultimate, Business, etc...)?
- Exactly how was the MRC Client Agent Service installed on this remote machine? Via a MSI package? Manually? etc..
- Have you also checked on the remote machine to make sure the "Permission Required" setting is not enabled within the MRC Client Agent Service (on the Additional Settings Tab)?
Please send us all this information for review.
However, you might also want to try removing the MRC Client Agent Service from the remote machine. Then build a new Vista 32-bit MSI package via the DameWare Installer Tool (DWRCSMSI.EXE), included in your DameWare installation folder. Also make sure to to reset all the Authentication Types options to Default on the General Tab, and make sure the "PermissionRequired" setting is not enabled on the Additional Settings tab, when building your MSI package.
Your feedback is appreciated.
Bryan Brinkman
Support Engineer
DameWare Development, LLC.
http://www.dameware.com
Re: connecting to a vista pc it always requires users permission
by mmenzie on Mon Sep 17, 2007 12:09 pm
Bryan wrote:Is this a Microsoft UAC (User Account Control) permission dialog? Or is this a Mini Remote Control "Waiting for Client to Accept Connection" permission dialog? Perhaps even send us ascreen shot of this dialog.
It is the MRC "waiting for client to accept"
Bryan wrote:- Which version of the MRC software are you currently running?
I am running MRC 6.6.1.1
Bryan wrote:- Which version of the MRC Client Agent Service is installed on the remote machine?
The version is 6.6.1.1
Bryan wrote:- Is the remote machine running a 64-bit version of Vista, or 32-bit?
it is a 32bit version of windows vista
Bryan wrote:- Also, which flavor of Vista are they running (Ultimate, Business, etc...)?
Vista Ultimate
Bryan wrote:- Exactly how was the MRC Client Agent Service installed on this remote machine? Via a MSI package? Manually? etc..
IT was done via .msi package
Bryan wrote:- Have you also checked on the remote machine to make sure the "Permission Required" setting is not enabled within the MRC Client Agent Service (on the Additional Settings Tab)?
Yes i did check that as well
Last edited by mmenzie on Sun Oct 28, 2007 11:00 am,
edited 2 times in total.
Re: connecting to a vista pc it always requires users permission
by mmenzie on Sun Oct 28, 2007 10:57 am
no help for my issues??
Re: connecting to a vista pc it always requires users permission
by bryan on Mon Oct 29, 2007 11:30 am
Hello mmenzie,
Honestly, it sounds like you haven't configured the MRC Client Agent Service properly. However, you might also want to do some additional reading on Vista and the new UAC security model, because Microsoft has made extensive changes in Vista.
Also, just FYI, even though you think you're created an account with Admin rights, under Microsoft's UAC (User Account Control) security in Vista this account is treated like any other regular user
account when you login. UAC splits the user's access token into two pieces (user portion, full admin portion), and you only receive your full Admin token when you request something that requires elevated rights, and even then it's only elevated within that specific window. Then you're back to being a regular user again. The only account that isn't UAC enabled is the true
"Administrator" account. Vista also disables this account by default, but you can re-enable it again.
However, I would suggest you remove & reinstall the MRC Client Agent on the remote machine, but do it via our MSI builder instead. This will guarantee the Service is installed correctly:
First download & install the current version of our software from the website (v6.6.2.0). Next, build a new MSI package to install the MRC Client Agent Service on this Vista machine using the DameWare MSI builder. After you configure and build the new MSI package, run the MSI pacakge on the Vista machine to install the Service. Now try your connection again. This should take care of this behavior.
I hope this helps.
Bryan Brinkman
Support Engineer
DameWare Development, LLC.
http://www.dameware.com
Re: connecting to a vista pc it always requires users permission
by slburke on Tue Dec 04, 2007 11:05 am
It doesn't appear that this was resolved either way (yes it can be done/no it can't).....I have had to disable UAC (wich we don't want) in order to get this functionality that exists in all other versions of Windows that I support.
So for the moment have removed Vista from my environment.
It surprises me that the developers are telling us "I don't think you have MRC agent configured correctly". The same configuration that works under XP SHOULD work
under Vista. I mean it's only a checkbox to say "don't ask for permission". Have the developers tried on Vista machines and KNOW that it works with UAC enabled?
Can anyone with Vista based machines verify if the following from Microsoft would correct the issue?
http://support.microsoft.com/kb/937624
Re: connecting to a vista pc it always requires users permission
by bryan on Tue Dec 04, 2007 12:45 pm
It doesn't appear that this was resolved either way (yes it can be done/no it can't)
There are no known issues connecting to Vista machines, and it's definitely possible to connectto Vista without requiring permission. However, Administrator vs non-Administrator credentials, as well as the "Permission Required" setting within the MRC Client Agent Service on the remote machine will determine if you require permission to connect to this machine using our software.
Also, have you checked for DWMRCS entries in Application Event log on the remote machine tosee exactly how you're authenticating to this remote machine (Administrator vs. Regular User)? Because non-Admins cannot connect to a remote machine without requiring explicit permissionfrom the Desktop User. Please send the entire text from these entries to our support team for review.
I have had to disable UAC (wich we don't want) in order to get this functionality that exists in all other versions of Windows that I support.
What exactly are you trying to do? Because provided the MRC Client Agent Service is already installed & running on your remote Vista machines, then you shouldn't have any problems simply making a connection, provided you're connecting via Administrator credentials. However, youwill not be able to remotely install, remove, start, or stop the MRC Client Agent Service to aremote machine running Vista with UAC enabled. These requests will be blocked by the O/S itself and it's beyond our control. Therefore, simply pre-install the MRC Client Agent Service on these remote Vista machines and you shouldn't have any issues.
However, that's also why we created the DameWare MSI Builder in version 6.x of the software, because the easiest and most efficient way to install the MRC Client Agent Service on all your remote
machines is by building a MSI package via the new DameWare MRC Client Agent MSI Builder (DWRCSMSI.EXE), which allows you to build custom MSI packages (including all settings, INI or Registry) to deploy the MRC Client Agent in your environment. These MSI packages can then be sent to your clients (or even distributed via Group Policies within Corporate Environments,
etc...) via any of your existing distribution methods. Using the MSI Builder toinstall the Client Agent Servcie also ensures that the MRC Client Agent Service is installed & configured properly for the designated O/S.
The same configuration that works under XP SHOULD work under Vista. I mean it's only acheckbox to say "don't ask for permission".
This is a fundamentally flawed statement for many different reasons.
◦First,
the ability to connect without requiring permission is determined by more that just the "Permission Required" checkbox, and it's the same for all Operating Systems, not justVista. Regardless of the "Permission Required" checkbox, non-Admins will always requirepermission to connect. So you have to make sure you're authenticating to this remote machine as an
Administrator not a non-Admin, or you will always require permission.
◦Second,
this is exactly the functionality of Vista's UAC security model, which means even though you thinking you're logging in as an Administrator, you're really not any longer. UAC splits your Access Token into two separate parts, an Administrator portion and a non-Admin portion. When you login, you always receive the non-Admin portion of your token. Only when you request something that requires Admin rights will UAC prompt you for elevation, and only then will you receive your full Administrator portion of your token (and only within that
specific window/process). Once that window is closed you're right back tobeing a non-Admin again.
Have the developers tried on Vista machines and KNOW that it works with UAC enabled?
YES. We have done extensive testing on Vista, and our entire support staff are all running Vistaon their machines as well, and we don't have any issues connecting to remote machines runningVista with UAC enabled without requiring permission.
However, if you're still having issues connecting to remote machines running Vista, then send as much information as possible to our support staff, and they will be happy to assist you in resolving this behavior.
Also keep in mind that only version 6.x of the software & Client Agent is supported on Vista.
I hope this helps.
Bryan BrinkmanSupport Engineer
DameWare Development, LLC.http://www.dameware.com
Re: connecting to a vista pc it always requires users permission
by slburke on Tue Dec 04, 2007 1:41 pm
First, I hope I didn't sound like I was trying to beat up on anyone...grin
Now I will answer your responses as best I can however I have no output to show or event logs as like I said I removed the offending machines from our environment.
Bryan wrote:However, Administrator vs non-Administrator credentials, as well as the "Permission Required" setting within the MRC Client Agent Service on the remote machine will determine if you
require permission to connect to this machine using our software.
Exactly, all users that use MRC here are either LOCAL administrators (on all workstations) or DOMAIN administrators.
Bryan wrote:
I have had to disable UAC (wich we don't want) in order to get this functionality that exists in all other versions of Windows that I support.
What exactly are you trying to do?
Remote control a Vista machine.
Bryan wrote:Because provided the MRC Client Agent Service is already installed & running on your remoteVista machines, then you shouldn't have any problems simply making a connection,
provided you're connecting via Administrator credentials. However, you will not be able to remotely install, remove, start, or stop the MRC Client Agent Service to a remote machine running Vistawith UAC enabled. These requests will be blocked by the O/S itself and it's beyond our control. Therefore, simply pre-install the MRC Client Agent Service on these remote Vista machines and you shouldn't have any issues.
Exactly, I agree, your statement SHOULD be true. But it is not. I tried installing remotely (which was blocked, matches your statement). However I also transferred the files locally to the
machine and did a manual install as well with same result of user at remote machine being asked for permission (read UAC prompt).
Bryan wrote:However, that's also why we created the DameWare MSI Builder in version 6.x of the software, because the easiest and most efficient way to install the MRC Client Agent Service on all your remote machines is by building a MSI package via the new DameWare MRC Client Agent MSI Builder (DWRCSMSI.EXE), which allows you to build custom MSI packages (including all settings, INI or Registry) to deploy the MRC Client Agent in your environment. These MSI packages can then be sent to your clients (or even distributed via Group Policies within Corporate Environments,
etc...) via any of your existing distribution methods. Using the MSI Builder toinstall the Client Agent Servcie also ensures that the MRC Client Agent Service is installed & configured properly for the designated O/S.
This did not work either.
Bryan wrote: The same configuration that works under XP SHOULD work under Vista. I mean it's only acheckbox to say "don't ask for permission".
This is a fundamentally flawed statement for many different reasons.
◦First,
the ability to connect without requiring permission is determined by more that just the "Permission Required" checkbox, and it's the same for all Operating Systems, not just Vista. Regardless of
the "Permission Required" checkbox, non-Admins willalways require permission to connect. So you have to make sure you're authenticatingto this remote machine as an Administrator not a non-Admin, or you will always requirepermission.
◦Second,
this is exactly the functionality of Vista's UAC security model, which means even though you thinking you're logging in as an Administrator, you're really not any longer. UAC splits your Access Token into two separate parts, an Administrator portion and anon-Admin portion. When you login, you always receive the non-Admin portion of your token. Only when you request something
that requires Admin rights will UAC prompt you for elevation, and only then will you receive your full Administrator portion of your token (and only within that specific window/process). Once that window is closed you're right back to being a non-Admin again.
How can this be a flawed statement?
■First,
all that's being done is transferring the same exact dwrcs.ini file to the Vistamachines that are on the 2000/XP/2003 machines.
■Second,
You originally stated that this behavior with the UAC does not happen. Now you sayit does. I'm talking about UAC prompting. The desired result is that if I connect as an Admin, UAC should not prompt the user on the "remote" machine.
Bryan wrote:
Have the developers tried on Vista machines and KNOW that it works with UAC enabled?
YES. We have done extensive testing on Vista, and our entire support staff are all running Vistaon their machines as well, and we don't have any issues connecting to remote machines running Vista with UAC enabled without requiring permission.
So you are saying that if no one is sitting at the remote machine,you can remote control theVista machine,no problem? Well, I cannot because UAC is waiting for someone at the remote
computer to click "OK". On my end I see "Waiting for client to accept connection" dialog from MRC. After a while the connection times out with a "remote control was denied", as if someone at
the remote computer clicked "Deny".
Bryan wrote:Also keep in mind that only version 6.x of the software & Client Agent is supported on Vista.
Using version 6.6.2.1
Bryan wrote:I hope this helps.
not yet (grin)
Re: connecting to a vista pc it always requires users permission
by Roger on
Tue Dec 04, 2007 2:11 pm
Could have been a mistype,but in your last comment you say "Well, I cannot because UAC is waiting for someone at the remote computer to click "OK". On my end I see "Waiting for clientto accept connection" dialog from MRC." But, before you said it was MRC's prompt on the remote end waiting for OK. If it is UAC, then there is nothing MRC can do about it. One quick test would be checking to prompt in MRC and see if you get two prompts.
One thing to try is to see if in fact the ini setting/file you deploy actually got there. Maybe itwas unable to copy or at the time the option may have been unchecked, etc...although you deployed by msi, so hopefully that shouldn't be an issue. I'd still connect to it and say ok to the prompt, then go to view menu and look at the settings on the remote machine/server and be sure they match what you expect. Specifically, on mine I have- General Tab= Allow Encrypted Windows logon and Must have logon local rights...although you could try without just in case that account can't logon locally, etc. Then on Access tab I have Only Admin to connect and the bottom 3 checks. You can try turning off only admin to connect or Permission required check at the bottom and see if that makes a difference.
I haven't used it, but it sounds like from the description you can take off the bottom 3 checks and gain access at the logon/locked prompt since no one is logged on (which sounds like what you describe) it would then let you in. Non-Admin with a user logged in remote sounds like it always requires permission, and admin can be required if you have it checked in the Additional Settings Tab...so lots of layers of security there.
Last edited by Roger on
Tue Dec 04, 2007 2:17 pm, edited 1 time in total.
Re: connecting to a vista pc it always requires users permission
by Roger on
Tue Dec 04, 2007 2:16 pm
While we are on the options for the Non-Admin users...that had me confused initially at first too since that bottom section doesn't have a header saying these setting apply to Non-Admin, itjust gives a description and assumes you read the whole paragraph and realize the bottom 3 checks are for Other/Non-Admin accounts not specified above. The paragraph would also look
better if left aligned and indented in a little. I didn't get that creative in my photo though.
Re: connecting to a vista pc it always requires users permission
by mmenzie on
Tue Dec 04, 2007 2:18 pm
well i have to agree with slburke on this one. i used the MSI builder to build the client and ran iton my vista machine and i double checked, even triple checked all the settings before i built itand when i try and connect to my vista machine i see "waiting for permission" and sure enough if i walk over to my vista box it is still sitting there waiting for someone to accept or deny. i have done all the things in this post that was suggested.
Re: connecting to a vista pc it always requires users permission
by Roger on Tue Dec 04, 2007 2:55 pm
If you did what I just posted too, only other suggestion would be maybe post the ini that is on the actual Vista Box. That is, if it isn't selected to store settings in the registry, then you would need to export those.
Re: connecting to a vista pc it always requires users permission
by slburke on
Tue Dec 04, 2007 4:53 pm
Roger wrote:Could have been a mistype, but in your last comment you say "Well, I cannot because UAC is waiting for someone at the remote computer to click "OK". On my end I see "Waiting for clientto accept connection" dialog from MRC." But, before you said it was MRC's prompt on the remote end waiting for OK. If it is UAC, then there is nothing MRC can do about it. One quick test would be checking to prompt in MRC and see if you get two prompts.
What I was saying that on my end I see response from MRC "waiting for client to accept connection" (whatever the actual MRC message is). On the remote machine, the UAC prompt is waiting. All this meaning that I shouldn't see a prompt from MRC and the remote user shouldn't see a prompt from UAC.
Roger wrote:One thing to try is to see if in fact the ini setting/file you deploy actually got there.
I am manually placing the files on the remote computer since I can't do a "push" install because of UAC. So yes the ini setting/file is there.
Re: connecting to a vista pc it always requires users permission
by slburke on
Tue Dec 04, 2007 4:57 pm
Roger wrote:If you did what I just posted too, only other suggestion would be maybe post the ini that is on the actual Vista Box. That is, if it isn't selected to store settings in the registry, then you would need to export those.
Settings aren't stored in the registry in version 5 or 6 of Dameware anymore (right?)
Re: connecting to a vista pc it always requires users permission
by slburke on
Tue Dec 04, 2007 5:01 pm
Roger wrote:Then on Access tab I have Only Admin to connect and the bottom 3 checks. You can try turning off only admin to connect or Permission required check at the bottom and see if that makes a difference.
The options on the Access tab are a non-issue as Administrators are not affected by it, and there are no "NON-Admins" attempting to use the application in my environment.
Re: connecting to a vista pc it always requires users permission
by Roger on Tue Dec 04, 2007 5:19 pm
Is this the prompt you see? If so then follow the instructions there to get rid of it without turning off UAC.
http://www.computerperformance.co.uk/vista/ConsentPromptBehavior.htm
Other than that you are correct that the access Tab shouldn't matter if the user is in fact admin. The additional settings tab would matter though, so make sure it is good. If the remote PC is
giving the UAC figuring out why would be the best thing. I haven't done much with Vista yet for these and numerous other reasons...including a way documented on many sites for actually removing the admin account and completely locking yourself out. I have used this type of protection on other OS like Ubuntu and Suse, and Vista's copy is less than adequate. What exactly does the UAC box
want permissions to do anyway? MRC should be just doing a passthrough login and not needing settings change, unless for some reason when it asks if the account is amember of the admin group Vista thinks it is requesting permissions??? Post the text/screenshot of the box if possible. One thing if this is the case would be maybe trying the other options on the Access
tab like making a group for the account and selecting it as a group, so it isn't just testing for admin and causing the prompt.
If nothing else works, the link above sounds like it gives a Yes to All to the prompts. If it still asks for a password on the major stuff it would work for me and not have UAC disabled...
Re: connecting to a vista pc it always requires users permission
by slburke on
Tue Dec 04, 2007 5:42 pm
Roger wrote:Is this the prompt you see? If so then follow the instructions there to get rid of it without turning off UAC.
http://www.computerperformance.co.uk/vista/ConsentPromptBehavior.htm
That be the one... Now there is another link on that page something to the effect of "Behavior of the elevation prompt...." That has a section titled "Local policy - Elevate without rompting" (Domain joined only). That looks promising, can someone try that out. I don't have any Vistamachines at the moment because of this issue, but would like to know if this works. BUT, itlooks like the only thing that can be done on a Vista machine NOT on a domain is to disable UAC altogether.
Re: connecting to a vista pc it always requires users permission
by mmenzie on
Wed Dec 05, 2007 8:19 am
Roger wrote:Is this the prompt you see? If so then follow the instructions there to get rid of it without turning off UAC.
http://www.computerperformance.co.uk/vista/ConsentPromptBehavior.htm
thats not the promp i am getting. i actually get the one from the dameware remote asking the user to grant permission for some one to remote in
Re: connecting to a vista pc it always requires users permission
by Roger on Wed Dec 05, 2007 12:26 pm
I don't know what else to say on this one. For the UAC prompt, it would be nice to see/know specifically what it is asking permissions for in the prompt, and did you try the registry key setting
ConsentPromptBehaviorAdmin to 0 to see if the box goes away? For the MRC prompt, if you are logging on with the admin account I'd verify the Additional Settings Tab on the Remote box...not your
machine or the default settings. Posting the actual ini file from the Vista box would be helpful too.
Other than that, Bryan mentioned they have all Vista machines in their environment and they worked. My only questions would be-
1. Are they all working with UAC on?
2. Are they all Vista Ultimate?
3. Were they tested in both a workgroup and NT/AD network?
If the answers to all 3 of those are yes, then it still sounds like a configuration thing. Going bya "I triple checked it" can't always be 100%. I can look at a piece of code I wrote for hours and never figure out the bug causing it not to work, but hand it over for a 2nd set of eyes to look at and they may find it in 2min. If the exact files/settings/msi file is used on all machines andVista is
the only one with problems, then it sounds like Vista needs tweaked.
Vista is a whole new beast and probably the worst initial releases M$ has made...yet people are bending over backward to support it. Both my anti-virus and firewall are pretty much useless and not getting any real updates for a month or more now just because they decided to supportVista and dropped all advanced features and any OS other than XP and Vista. They dumbed downa perfectly good piece of software just to be "compatible" with that garbage. In my opinion itneeds to be the other way around...they need to fix Vista and make/allow it to work properly. Until they do, there are lots of things to tweak and make it work.
Re: connecting to a vista pc it always requires users permission
by slburke on
Wed Dec 05, 2007 1:36 pm
Roger wrote:I don't know what else to say on this one. For the UAC prompt, it would be nice to see/know specifically what it is asking permissions for in the prompt, and did you try the registry key setting ConsentPromptBehaviorAdmin to 0 to see if the box goes away? For the MRC prompt, if you are logging on with the admin account I'd verify the Additional Settings Tab on the Remote box...not your
machine or the default settings. Posting the actual ini file from the Vista box would be helpful too.
Roger wrote:Other than that, Bryan mentioned they have all Vista machines in their environment and they worked. My only questions would be-
1. Are they all working with UAC on?
2. Are they all Vista Ultimate?
3. Were they tested in both a workgroup and NT/AD network?
don't forget the biggest question...Is there any interaction ATALL by the remote user?
Roger wrote:If the answers to all 3 of those are yes, then it still sounds like a configuration thing. Going by a "I triple checked it" can't always be 100%.
Again, in my case, all that was done was to take VALID configuration that is on every other machine in my environment and move it to a Vista machine. So I would say that it's definitely 100%.
Re: connecting to a vista pc it always requires users permission
by bryan on
Wed Dec 05, 2007 3:38 pm
Hey Everybody,
Many thanks for everyone's contributions on this post. I think we just need to take a step back here, and we should be able to get this resolved. Because I really want to help you get this resolved, and there is no reason you shouldn't be able to connect without requiring permission.
OK, from everything that everyone is including below this is definitely a MRC Permission Prompt and not a UAC prompt, and there are only two ways the MRC software will ask for permission.
1. Permission Required is enabled on the remote machine, either in the DWRCS.INI file or in the Registry.
2. You are connecting with non-Admin rights, in which case you will require permission.
That's it. There are no other settings to ask the user for permission.
With regard to non-Admin rights, I know you said there are no non-Admin users. However, you have to remember how UAC works, because all users (even Administrators) are treated as non-Admins under UAC. That is, except the "Administrator" account which is disabled by default underVista. The "Administrator" account is not UAC enabled, and therefore it's always considered an Administrator, with or without UAC.
You also stated below you took the same configuration from your other machines and applied itto this Vista machine. Does this mean you took your MSI file you created for NT/2000/XP/2003 and used it to install under Vista as well? Because that may be part of your issue. If you look in the MSI builder, Vista has it's own build because Vista is fundamentally different that these other MS Operating Systems when UAC is enabled. Just as an example, Vista no longer supports Interactive Services. So you MSI file for NT/2000/XP/2003 will install the MRC Service to Interact with the Console, whereas, if you create a Vista Build that flag is no longer set.
Also, which authentication method are you using to connect? Also since this is Vista, make sure the "Must have Locally Logon Rights" checkbox is not enabled under the Allowed authentication methods on the remote machine.
If this still doesn't resolve this behavior for you, please make sure you don't have any settings stored in the Registry on the remote machine. Because if the settings are being retrieved from the Registry, then the DWRCS.INI file will be ignored.
[HKEY_LOCAL_MACHINE\Software\DameWare Development\DWRCS\Settings]
If the "Use Registry for all Settings" value is set to dword:00000001, then your Client Agent settings are being retrieved from here instead. You can set it to dword:00000000 or make the necessary changes in the Registry for Permission Required.
Your feedback is greatly appreciated.
Bryan Brinkman
Support Engineer
DameWare Development, LLC.
http://www.dameware.com
Re: connecting to a vista pc it always requires users permission
by Roger on
Wed Dec 05, 2007 4:12 pm
Ahh, so does the Logon Locally being off tell it to just check the group and not actually logon and try to test for admin since it will be a plain user in that case due to UAC? That sounds valid. I never noticed the Service was Interactive. I'm guessing that is to access the Task Tray menu. So, in Vista is it not possible to have the menu in the Tray then? I never had much luck writinga Service to be
Interactive, they usually end up crashing on Windows Shutdown.
Re: connecting to a vista pc it always requires users permission
by bryan on
Wed Dec 05, 2007 4:25 pm
Hey Roger,
Not exactly. Only the "Must be a member of .." features really check group membership. The software just does a different type of logon with or without the "Must have locally logon rights" checkbox enabled. For Vista, you basically don't want that checkbox enabled, however, the MSI builder should already take care of that for you, provided you select Vista as the Target O/S.
Also, I believe the "Interact with Desktop" setting in the Service Properties had more to do with acquiringthe screen information, not really the SysTray icon. For example, take a XP machine and reconfigure the Service to not Interact with the Desktop. Then when you connect you will just get a Black Screen in your MRC window. So we basically had to do things a completely
different way in Vista, but it actually works very well under Vista.
Best Regards,
Bryan Brinkman
Support Engineer
DameWare Development, LLC.
http://www.dameware.com
Re: connecting to a vista pc it always requires users permission
by auto on
Wed Jan 02, 2008 6:55 pm
You stated that it is a workgroup setup. Apparently VIsta security has an additional setting so that a matching local administrator username and password on both PCs does NOT automatically allow access to a remote administrative share. I haven't had a chance to test this but it may explain the issue you are experiencing.
Set - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\LocalAccountTokenFilterPolicy to 1(DWORD).
To do this:
- Click start
- Type: Regedit
- Press Enter
- Browse to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system
- Right-click a white area in the right pane
- Click New
- Click Dword Value
- Type: LocalAccountTokenFilterPolicy
- Press Enter
- Double-click LocalAccountTokenFilterPolicy
- Type: 1
- Press enter
- Restart your computer
Auto
Re: connecting to a vista pc it always requires users permission
by wcabello on
Sun Jan 27, 2008 7:55 pm
Hello Brian, It seems that this problem is an on-going problems with users connecting remotelyto Vista computers. I also have tried all of the suggestions and I have not secceeded yet either. The blue windows still pops up saying waiting authorization from the user (local person in that computer). I modified the registry as suggested, restarted the computer and it does not do the
trick either. Have you or anybody in Dameware can solve this issue once for all and provide afinal solution to their customers. Thanks
Re: connecting to a vista pc it always requires users permission
by bryan on
Tue Jan 29, 2008 6:50 pm
Hello wcabello,
Not really. I still have not been able to reproduce this behavior, and outside of this post I also haven't had any other users write to me in Support with this behavior on Vista.
However, I believe you also wrote to support directly as well, and the reason this is not working for you is because version 5.x is not supported on Vista. You must be running version 6.x of the software both locally & remotely in order to support Vista.
Best Regards,
Bryan Brinkman
Support Engineer
DameWare Development, LLC.
http://www.dameware.com
Re: connecting to a vista pc it always requires users permission
by revolutn on
Thu Jan 31, 2008 12:28 am
OK.
I've read the entire thread, all 3 pages.
Here's what I can tell you.
I made MRC work with a Vista home premium pc tonight,without doing anything to UAC at all.
Here's what I did.
I downloaded the latest latest 6.7.0.2.
I used MSI builder to make an installation package for Vista32bit.
I chose PROPRIETARY CHALLENGE RESPONSE for authentication type. put in a user name and password (since I wouldn't have an account on the target remote clientpc)
I emailed the msi package to the recepient and they ran the installation.
I configured the router to pass traffic on 6129 to their nat'd lan ip.
I told the end client to be ready to give me permission if they were prompted.
I put in their public IP address in the host window. changed the authentication type to proprietary and supplied the credentials i created above.
clicked connect.
On the remote side, the client accepted the UAC request.
I was connected without further ado or incident.
Now, it may well be that 6.7.0.2 addresses some issue that was present in 6.2.x.x, but this was not as difficult as I feared after reading this thread.
I will confirm later if I can eastablish subsequent unattended connections at a later time, but I've disconnected and reconnected several times in the same session, boot cycle without the user being prompted to do anything.
Hope this information and my experience helps some of the struggling peeps on this thread.
Rev
Re: connecting to a vista pc it always requires users permission
by bryan on
Thu Jan 31, 2008 4:35 am
Hi Rev,
Many, many, many thanks for your feeback. This is exactly how it's supposed to work,and exactly how it has worked for all6.x versions of the software, without having to alter UAC at all. So, like you, I'm not sure why others are having so much trouble, because it should not be that difficult.
However, I did find out why the previous poster had issue with permissions on Vista, and it was because he was running version 5.x of the software,which is not supported on Vista.
Thank you again for posting this information about your experiences. It's nice when someone other than the support guy can back this upas well .
Best Regards,
Bryan Brinkman
Support Engineer
DameWare Development, LLC.
http://www.dameware.com
Re: connecting to a vista pc it always requires users permission
by bobbyb on
Mon Mar 17, 2008 7:50 am
I've also gotten this to work with Vista Home Premium, but as a heads up, I have seen what you are talking about. It matters what logon method you are using, use the proprietery challenge/response method,not the windows logon. If you use the other method, the administrative rights come into play. If you use the proprietery method, it doesn't have any issues.
Also, when I set it up, I could connect without any UAC popping up. Period. However, if I chose another authentication method, it would pop up the UAC. As long as you do the right method, you shouldn't have a problem.
Remember you must have credentials with the following permissions in the remote machines for this to work:
