Remote Assistance UAC checkbox

[irbk]

We are starting to look at rolling out Windows 7 in my company. Most of the support we do is through NetMeeting. However, since MS decided to remove NetMeeting, we are looking at using the Advance Remote Assistance "help desk" option. This seems to work fairly well in Windows 7. So here is my question, when you run the "Advanced Remote Assistance", make the connection and then do the "request control" the user gets a prompt asking if "would you like to allow X to share control of your desktop?" On this prompt, there is a checkbox to "Allow X to respond to User Account Control prompts". I'm wondering if there is a way in Group Policy to have this box checked by default? My users are typical users and have a tendancy of clicking "yes" before reading any customized warnings or before I have a chance to tell them to check the box before clicking yes.
In the searching that I've done, I've not found anything that would allow that. I believe that it is this way and can not be customized for security reasons. However, I figured it wouldn't hurt to ask to see if anyone knows differently.

Thanks in advance.

 

[linney]

This covers the Group Policy settings that seem applicable to that area but as to whether changes can be made to any checkbox I'm not sure.

"User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop" is controlled by a Registry Key or Value called "EnableUIADesktopToggle" according to this article.

UAC Group Policy Settings and Registry Key Settings

http://technet.microsoft.com/en-us/library/dd835564(WS.10).aspx

http://www.google.com/search?hl=en&...trol+Prompts"+allow&btnG=Search&aq=f&oq=&aqi=

User Account Control: Allow UIAccess Applications to Prompt w/o Secure Desktop

http://netsecurity.about.com/od/secureyourwindowspc/qt/uacuiaccess.htm

"UAC: Allow UIAccess applications to prompt for elevation without using the secure desktop:"
How to manage Vista’s UAC with Group Policy

http://www.frickelsoft.net/blog/?p=68

 

[irbk]

Linney,
Thanks for the response. What this setting will do is not "pause" the Offer Remote Assistance window for the "helper" while the person needing help enters admin credentials. For the boxes this works on, it works great (all my users don't have admin rights), but for some reason, the group policy doesn't take effect on every box. As far as I can tell, it seems to work on the Win 7 boxes that have the Windows 7 admin tools installed, and not work on the boxes that don't have it installed. I don't know why that would be.

 

[irbk]

I just checked my 2003 server and I don't see the UAC group policy settings in there. Is there some kind of "group policy update" program that I need to install on my 2003 server so that it has the UAC settings in there? Perhaps this is why some of the boxes are getting the correct UAC settings (those with the Admin tools installed) but other's are not?

 

[linney]

You might be better off in some of the Server Forums and see what they are doing to handle Windows 7 and Vista clients? Are there any later 2003 Adminpaks available to you?

http://www.tek-tips.com/threadminder.cfm?pid=931

http://www.google.com/search?q=Serv...-au&ie=UTF-8&oe=UTF-8&startIndex=&startPage=1

Any clues from these type of threads?

Where to find ADM files for Vista
thread1583-1497546

importing admx templates into 2003 GPOs?
thread1583-1344484

 

[irbk]

After hours of searching, and finding no rhyme or reason to why some computers didn't "pause" the remote helper screen, while others did, despite the GPO settings, we finally broke down and not only enabled the "User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop" but also disabled the "User Account Contol: Switch to the secure desktop when prompting for elevation". I know that disabling the later opens us up to risks, as the UAC prompt can be spoofed, but found no other option. What really is killing me is the fact that, with only the "Allow UIAccess applications to prompt for elevation without using the secure desktop" enabled, with User A logged onto computer A, things work correctly. However, with User A logged onto computer B, they don't, and from everything that I can tell, group policy is the exact same on both of them (be it the group policy of the domain or local policy).