[wpkg-users] WPKG and User Account Control Warnings

[Nicolas BRICHE]

Hello all,

heiko.helmle at horiba.com a écrit , Le 01/03/2013 07:43:
>> > We have created a script that includes WPKG. The script is called from
>> > a browser when a user performs an action (e.g. pushes a button).
>> >
>> > However, every time the script is called to make an install/uninstall,
>> > UAC comes into the picture and issues a warning.
>> >
>> > We can of course disable UAC, but it does not sound like a good idea.
>> >
>> > Does anyone have any insights into how to stop UAC warnings when WPKG
>> > is trying to install/uninstall software?
>> >
>>
>> You can't stop it if the installation needs administrative rights.
>>
>> If the installation is run by a service, you could overcome this
>> limitation of Windows.
>>
> 
> Only thing you could do is start the script itself already elevated. This way
> you'll get only one UAC prompt instead of one on every install cmd.


One way to do that would be by using an intermediary:

Instead of the script launching WPKG directly, it submits a request to a server,
which runs WPKG remotely on that client, logged as an admin user (see psexec,
winexe...).  That centralized method also allows you more control over, well,
everything: access rules, running delays, logging, etc.

And I'm not sure, but it may also bypass the UAC prompt.

I also like the service route, mostly because Python makes it easy ^_^, but it
also adds yet another background process.  For recent clients it may be peanuts,
but I'm still running a few 8- and 9-year old PCs.  They probably wouldn't like it.


I'm currently using half of that solution: I'm manually running WPKG from my
server, using wrapper scripts.  This allows me to push any number of packages to
any number of clients at once, using a set list of possible users with admin
rights.  If I let the scripts run a week or so I'm reasonably sure to have a 90%
up-to-date pool (200 clients) for those packages.

It's currently a jumble of bash scripts wrapping winexe, but I'm confident I can
finish rewriting them in Python-Cherrypy sometime this year.  That would add the
UI I want, but also allow for an user-accessible URL path (from an intranet for
example).

N.