UAC admin prompt

Help & Support
1

Hi Leo,
Need some assistance on UAC. We have an expression in french which say: I am a bit "rusty" about the subject. Meaning I may have forgot something about it. Perhaps you have the same in English.
Anyway here the situation.
Following good advise from you and Jon, I started to use "privilege" for some hidden folder to avoid they get deleted even if they are hidden.
So, basically, I am using this command from window to deny access to EVERYONE to some critical folder.

ICacls "D:\Pending Transaction folder" /deny  *S-1-1-0:(OI)(CI)W /T /C /Q

This prevent access to everyone to that folder.
Now I have created a Button on my toolbar to remove the privilege from this folder so I can access it as an administrator. I am in ADMIN mode with this computer.
Now when I run this command from a USER-DEFINED-COMMAND called Lock OFF:

Icacls "D:\Pending Transaction folder"   /remove:d *S-1-1-0 /T /C

I always get an Admin UAC prompt window.

But if I run it directly from the Button, I don't get any UAC PROMPT WINDOW.
I have created a User-defined-command as it was easy for me to create a few Button calling different locked folder and simply calling from those button LOCK OFF instead of having to write this code above in each button.
So my question is : Why I get a UAC PROMPT WINDOW if this sequence of code above ( The one with /remove) is called from a User-defined command and why I don't get UAC PROMPT window if the command is run inside the Button as itself without a call to LOCK OFF. In both case OPUS run with no elevated privilege. I find it annoying to get this UAC PROMPT WINDOW unless I turn off UAC or move the code line inside of any Button needing it. Advise on that?
:unamused:

2

Which program does the UAC prompt say it's coming from, Opus or ICacls?

3

The Prompt say:
Program name: Directory OPUS 11 (UAC Elevator)
Verified publisher: GP Software
File Origin: Hard driver on this computer
( On show more)
CLSID: {75C235EA-9D69-430B-92DD-C04B5FA48A4}

4

Is what you've given above the full details of the command?

Is there an @admin directive anywhere which is missing from the forum post?

Running icacls.exe on its own should not trigger a UAC prompt by itself.

5

Hi Leo,
That is what I thought too about ICacls. On its own it should not trigger a UAC prompt. What you got here, is the full details of the command. (very simple one)
But, now that you mention @admin modifiers, I remember when I created the User-defined-command (UDC) LOCK_OFF, I clicked on @modifiers to put at the top a @nodeselect. But by mistake I had putted @admin. I did got a prompt at first when I ran the UDC since I had a @admin directive. But I removed it right away from the UDC. I even deleted the Button and created again with only the ICACLS command.
But could it be possible that this mistake got persistent in the OPUS config file? Also why if I put the ICALCS command straight in the Button it does not trigger a UAC prompt but when called from a UDC it does.
:open_mouth:

6

Please post screenshots of everything involved so we can see exactly what you are running.

7

Hi Leo,
No idea of what you mean by post screenshot of everything involved ? Does it means any layout, button (the whole Opus config) or just what is related to my question?
I have to say that I am a kind of experimenting at this point since I moved to OPUS 11, going from simplicity to complexity eventually.

But first let's start by something simple which I should have mention first (as a confusion from me or a bug) and related somewhat to this topic.
On my toolbar, I have 2 button. Turn_LOCK_On, Turn_LOCK_Off. So before going on the UAC prompt situation I will give you this first problem or not that I should have mentioned first.
I have 2 important Directory that are hidden and protected :
D:\Pending Transaction Folder, D:\ Pending Payment Folder.

Turn_Lock_On Button does this:

Lock_ON PATH_TO_LOCK="D:\Pending Transaction Folder"
Lock_ON PATH_TO_LOCK ="D:\ Pending Payment Folder"

Turn_Lock_OFF Button does this:

Lock_OFF PATH_TO_UNLOCK="D:\Pending Transaction Folder"
Lock_OFF PATH_TO_UNLOCK ="D:\ Pending Payment Folder"

Each Button Call either UDC Lock_ON or Lock_OFF

UDC: Lock_Off
Template: PATH_TO_UNLOCK/O
Function: Standard Function

@nodeselect
Icacls "&Path_to_Unlock&"  /remove:d *S-1-1-0 /T /C

UDC: Lock_ON
Template: PATH_TO_LOCK/O
Function: Standard Function

@nodeselect
ICacls "&Path_to_Lock&" /deny  *S-1-1-0:(OI)(CI)W /T /C /Q

Now if I click on either Button (Turn_OFF or ON), only the first line of code (call to the UDC Lock_ON or Lock_OFF) is execute. The second call to the same UDC with a different folder is never execute. So, is it a BUG or only once instance of a UDC (User-defined-command) can be call in a main Button function ?

Please answer this one before carry on with UAC. And tell me if anything wrong in my coding as it can be easily reproduce. I use double quote for the path used for argument to the UDC and use again double quote around the argument "&...&" as it is the only way for window to execute perfectly ICALCS due to space char, the nightmare of window.

8

I'd like to see screenshots of the button editors, not transcriptions of them, please.

For example, I can see a mistake in one of your transcriptions:

Lock_ON PATH_TO_LOCK ="D:\ Pending Payment Folder"

You have a space after the D:\ which should not be there. I don't know if you made a mistake just in the forum post, or if the mistake is also in the real button you are running.

9

My goodness! Sorry. It was a mistake in the forum. There is no space between the D:\ and the name of the folder in my Button.

10

Hi Leo,
This is a screenshot of the 2 Button and the 2 UDC. And as I mentioned before, only one line in each Button is executed. Not the second line.

b83bdd1bde2914bc6b86cf14895fd7a051bc9d62.jpg1340×840 192 KB

11

I would remove the spaces you have before the = signs on some lines, but apart from that I can't see anything that really looks wrong. Nothing there should trigger a UAC prompt on its own.

12

Hi Leo, I did remove the space (bad habits from me).
But as I said above, before getting to the problem of UAC, the 2 Button I showed you above in the PIC (not the UDC), only the first code line is execute in each button. Meaning only one directory get Lock or Unlock. The second line (second call to UDC Lock or Unloc) never get execute. Is it as BUG or only one instance of a call to a UDC must be in a main Button ?

13

It's possible the icacls command is failing (maybe because it needs admin rights) and stopping the rest of the command.

To be honest, it's a bit confusing if we keep jumping from one problem to another and cannot focus on one thing at a time. I'd like to focus on and finish the "UAC Admin Prompt" aspect of this first, since that's where we started and the subject of the thread.

14

You are right. Sorry for that.
Now, while I am a bit embarrassed, :blush: I believe I just fix the problem with UAC prompt. Hopefully with my shaky English, I can explain it well.

So, basically, I have a unique Toolbar that contain this 2 Button (describe above) and 6 others for admin purpose. By default, OPUS open in a Dummy LAYOUT, which do not contain This Unique Toolbar. So, when I use my PC (not somebody else) I switch layout if I have to leave my PC unattended and somebody else need to use it. Not a big security but it does the job for now.

But, I just find out that I had those 2 extra Button (TURN_LOCK_ON, TURN_LOCK_OFF) part of my Dummy Layout, the one that open with OPUS and I got confuse, THINKING THAT I HAD ALREADY TURN ON my unique ToolBar. (NEED TO ASSIGN A DIFFERENT COLOR TO THIS UNQUE TOOLBAR)
The problem was that while the Button (TURN_LOCK_OFF) was an exact duplicate of the same Button in my unique ToolBar, it was a different story with the Button (TURN_LOCK_ON) in the Dummy layout. This Button contained an extra line as such:

SETATTR "D:\Pending Transaction Folder" SETATTR HR recurse
Lock_ON PATH_TO_LOCK="D:\Pending Transaction Folder"

So, when I opened this Topic, I was still using my Dummy Layout until you (LEO) asked me for a screen shot. Without thinking, I switched to my Business Layout and did the screenshot. But now, I just tested the Button and no more UAC Prompt. I got more confuse. So I turned off OPUS and re-started it with the Dummy Layout by default and this is when I saw the 2 Button that should not have been there and causing the UAC prompt because of this extra line of code "SETATTR".
I removed them form my Dummy ToolBar. But by curiosity, why the SETATTR as mentioned above would cause a UAC PROMPT (and anyway it was useless to use it since the folder was access denied)
Anyway, it was my mistake and unless you see something unusual with the SETATTR causing a UAC prompt, I would say this UAC problem is clause. Sorry for the confusion.

Now should I open a new topic with the next problem, which is why the 2 call to LOCK_ON or LOCK_OFF, only one get executed ? And now this time there is no confusion. I am with my business layout and the screenshot I sent to you is exactly what it is for those 2 Button and the 2 UDC :open_mouth:

15

Hi Leo,
Hope We can still sort out the next problem mentioned on my last comment.
But as regard UAC, despite I found the error (if it was one legitimate error from me) I realized that if I use an internal command Like COPY or SETATTR followed immediately by a call to the UDC LOCK_ON (folder where copy was done), I am always getting an UAC prompt because I believe that the command COPY or SETATTR are still running while the call to the UDC LOCK_ON is perform, causing an UAC Prompt. Those it make sense ?

16

If Opus's SetAttr command thinks it requires admin rights to make the change you've requested, you'll get a UAC prompt.

17

:sunglasses:
Cool. So this close the subject and make sense.
Now, should I open another topic or just carry on with this one as regard having 2 call in a row to the same UDC in a Button but only the first one is execute as showed in the PIC I sent to you ?
:unamused: