@manxam said in Change Local Admin Pwd?:

@flaxking said in Change Local Admin Pwd?:

Fyi, to deploy to clients you just need to copy the dll and register it with regsvr32. But good thing you're not trying to deploy it with GP's software installation features.

What's wrong with using GP software deployment for LAPS? This has always been my method using their msi and I've never experienced an issue.

I've just had a lot of issues with the GP's built in Software Installation feature, and I've heard the same from other techs. What I've seen is installations getting stuck and thus locking people out of their computer, and also it installing again even when the software was successfully installed.

I would imagine the LAPS msi should be so small it wouldn't give much issues, but IMO GP's software installation feature should be left untouched.

@siringo said in Change Local Admin Pwd?:

Hey thanks for all the help everyone, it is greatly appreciated.

I've decided to go with LAPS as this is part of an overall 'let's tighten up security' project I've got going and my thoughts were, you can't go wrong if you go with the Vendor's recommendation.

I'm distributing the LAPS client software via Startup GPO which is working well ATM. Half way through the setup, but have stopped coz the weekend started.

I'll take a look at Salt as I need to broaden my horizons.

Thanks again folks.

Fyi, to deploy to clients you just need to copy the dll and register it with regsvr32. But good thing you're not trying to deploy it with GP's software installation features.

@wrx7m said in Windows 10 - Application Incorrectly Requiring Admin Creds to Run:

@flaxking said in Windows 10 - Application Incorrectly Requiring Admin Creds to Run:

@wrx7m check for an applicationname.exe.manifest file in the same directory as the exe. If it's there, rename it and the application might not request admin permissions and enable the virtual store.

Note, the virtual store for a user doesn't seem to ever update. So if you do a program update, any file that gets updated that had to be transferred to the virtual store will not get updated for that user.

There are manifest files, but for vc90, so visual studio runtimes. The UAC virtualization shows Not allowed for the process and sub processes.

Hmm, if they explicitly disabled it it should show disabled. Maybe it's 64bit?

@JasGot said in Windows 10 - Application Incorrectly Requiring Admin Creds to Run:

@wrx7m said in Windows 10 - Application Incorrectly Requiring Admin Creds to Run:

I just tried modifying UAC again to never notify. When I go into UAC as my admin account, it is set to never notify. If I go into UAC as the user, it shows as the one just below the top. How does that make sense?

No. It should be system wide. If you set it to never ad admin, it should be never for everyone. Is it on a domain? Is there a GPO stepping on you when logged in as a user?

So much confidence.... but UAC prompt for standard users vs admin users are different settings

I forgot that you might also have to modify the date modified of the .exe before after you delete the manifest

Set-ItemProperty applicationame.exe LastWriteTime (Get-Date)

@wrx7m check for an applicationname.exe.manifest file in the same directory as the exe. If it's there, rename it and the application might not request admin permissions and enable the virtual store.

Note, the virtual store for a user doesn't seem to ever update. So if you do a program update, any file that gets updated that had to be transferred to the virtual store will not get updated for that user.

@Dashrender said in Windows 10 - Application Incorrectly Requiring Admin Creds to Run:

Wasn't there supposed to be some type of virtual directory system and virtual registry to allow shitty applications like this to write to what they believed where these locations without actually compromising the system? Or am I smoking crack? or was it talked about, but was really only vaporware.

the Virtual Store. In Task Manager in Details there's a UAC virtualization column that will tell you if it is active or not. It's possible they've created a manifest file to disable it and prompt for admin credentials. If they've left it as a file it can be edited, if they've compiled it with the application I'm not sure if creating a manifest file would overwrite it or not

https://www.jobbank.gc.ca/jobsearch/jobposting/31345703

I suspect it's listed in Alberta to get more applications without having to raise salary expectations.

C'mon guys, I might as well just join Reddit if everyone is going to be so touchy.

@Obsolesce said in How-To / Community Documentation & Resources:

@flaxking said in How-To / Community Documentation & Resources:

@Obsolesce said in How-To / Community Documentation & Resources:

@notverypunny said in How-To / Community Documentation & Resources:

I searched really quickly and didn't find a section or category where folks have been posting useful how-to guides or articles for the community. There are a couple of things that I've worked through lately that could probably be useful to others, just don't know exactly where to stash it on here. As an example, how to make a uefi bootable USB to automatically apply BIOS settings for Dell. In all honesty, my motivation here is as much to share with the community as have stuff like this publicly documented so I can find it if I need to re-do or update it for my own needs.

Store them on GitHub GitLab

GitHub works excellent for me, no issues. What issues are you having with it?

GitLab has been more feature rich for such a long time now that I have no idea what GitHub is missing because it didn't fit my needs when I started using GitLab. I've been using free private repositories and the shared runners on GitLab for quite a while now.

I have heard that GitHub is doing better for features since bought by Microsoft, but with GitLab's Web IDE and web terminal for shared runners on the way, I doubt I will be looking over to GitHub.

Plus you have GitLab as an amazingly transparent company, and then on the other side Microsoft who is still in the business of lock-in.