Need help with UAC

[Baires]

This is the scenario: the user requesting assistance is not an admin and doesn't know the password for the admin account. The tech providing assistance knows the password for the admin account. The goal is for the tech to be able to use programs that require admin privileges without disclosing the admin password to the user.

I understand that in order for the tech to interact with the UAC prompts, VNC needs to be running as a service.

If the user runs InstantSupport, then the tech connects remotely and selects "Install Service" in the tray icon, then he is disconnected before the client PC asks for admin credentials for UAC, so the user needs to enter the credentials.

Can anybody think of a solution?

Thanks!

Alex.

[B]

Aha, the old chicken or egg scenario!

Is it possible for the tech to provide an admin password (hopefully not that of a domain administrator but merely a local administrator) and then just change it once he has full control?

A crappy workaround, I realize, but a workaround.

UAC is really a pain.

It's not even completely clear to me whether a limited user can turn it off (I think not).

But if I think about it another way, if the person with Admin rights has chosen not to let the limited user run privileged programs, why should a remote version of that Admin user be allowed to run privileged programs through a <b>limited user's</b> login? The security model makes sense. The right way to do things is for an administrator to pre-install VNC or RDP, etc. before a remote person can do such things.

Does using a RunAs command still cause a UAC prompt (I think it does)?

Hmm, looks like some people get around this via the scheduler...

http://www.sevenforums.com/tutorials/11 ... reate.html