Toggle UAC to allow script to run without any prompts

[kgreer]

Hello,

I found this script:

I tried to use the modded code by Smashly, but it would not run correctly. I have changed the code sligthly from the original and it seems to function properly and I see, in the User Account Control settings, the slider reflects the setting it should be.

I just want to throw this out there to see if I am missing anything important with the code. Thanks!

expandcollapse popup

#RequireAdmin
#RequireAdmin
#include "Constants.au3"
global $iPreviousValue
$iPreviousValue = _Toggle_UAC()
msgbox(0,"$iPreviousValue",$iPreviousValue)
sleep(7000)
msgbox(0,"","Sleep Over")
$iPreviousValue = _Toggle_UAC()

; #FUNCTION# ====================================================================================================================
; Name...........: _Toggle_UAC
; Description ...: Toggle or Force UAC Off or On or Query UAC current setting without changing.
; Syntax.........: _Toggle_UAC([$iValue = -2])
; Parameters ....: $iValue - [Optional] Default is -2, see below for explanations and other values.
;                        -1 = Toggle the current UAC to the oposite of what it is currently.
;                            If UAC is curently disabled then It will be enabled using 1,
;                            Prompt the Consent Admin to enter his or her user name and password
;                            (or another valid admin) when an operation requires elevation of privilege.
;                        -2 = Toggle the current UAC to the oposite of what it is currently.
;                            If UAC is curently disabled then It will be enabled using 2,
;                            Admin Approval Mode to select either "Permit" or "Deny" an operation that requires elevation of privilege.
;                        -3 = Return the current UAC value found in the registry, don't change anything.
;                        0 = Set UAC to 0 Allow the Consent Admin to perform an operation that requires elevation without consent or credentials.
;                        1 = Set UAC to 1 Prompt the Consent Admin to enter his or her user name and password
;                            (or another valid admin) when an operation requires elevation of privilege.
;                        2 = Set UAC to 2 Admin Approval Mode to select either "Permit" or "Deny" an operation that requires elevation of privilege.
; Return values .: Success - Value that was found in the registry before changinging and @error 0, Return could be as follows:
;                        0 = UAC was disabled
;                        1 = UAC was Prompt the Consent Admin to enter his or her user name and password
;                        2 = UAC was Admin Approval Mode to select either "Permit" or "Deny"
;                Failure - -1 and @error
;                        @error 1 = Current user is not Admin
;                        @error 2 = OS is not Vista or Win 7
;                        @error 3 = Reading the the registry key failed, check @extended for the returned error from RegRead() as to why it failed.
;                        @error 4 = Writing the registry keyname value failed, check @extended for the returned error from RegWrite() as to why it failed.
;                        @error 5 = $iValue parameter not valid
; Author ........: AlienStar
; Modified.......: smashly
; Remarks .......:
; Related .......:
; Link ..........: http://msdn.microsoft.com/en-us/library/cc232761%28v=prot.10%29.aspx
; Example .......:
; ===============================================================================================================================
Func _Toggle_UAC($iValue = -2)
If Not IsAdmin() Then Return SetError(1, 0, -1)
If Not StringInStr("WIN_VISTA|WIN_7", @OSVersion) Then Return SetError(2, 0, -1)

Local $sHKLM, $sName, $iReadValue, $iNewValue
$sHKLM = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
$sName = "ConsentPromptBehaviorAdmin"
$iReadValue = RegRead($sHKLM, $sName)
;msgbox(0,"$iReadValue",$iReadValue)
;If @error Then Return SetError(3, @error, -1)
;msgbox(0,"@extended",@extended)
Switch $iValue
     Case -1, -2
         Switch $iReadValue
             Case 0
                 ;$iNewValue = Abs($iValue)
$iNewValue = $iPreviousValue
;msgbox(0,"$iNewValue",$iNewValue)
             Case Else
                 $iNewValue = 0
;msgbox(0,"$iNewValue",$iNewValue)
         EndSwitch
     Case -3
         Return SetError(0, 0, $iReadValue)
     Case 0, 1, 2
         $iNewValue = $iValue
     Case Else
         Return SetError(5, 0, -1)
EndSwitch

RegWrite($sHKLM, $sName, "REG_DWORD", $iNewValue)
If @error Then Return SetError(4, @error, -1)
Return SetError(0, 0, $iReadValue)
EndFunc ;==>_Toggle_UAC

[LarryDalooza]

Requires reboot

[kgreer]

Setting changes without a reboot. What makes you say that?

[guinness]

Toggling UAC is a bad idea, it's there for a reason.

[kgreer]

in one specific script I have I need to install network printers. W7 prompts if I trust the driver and I have to click yes/ok for each new driver that dowloads from the print server. If UAC is disabled, then there is no prompt and the process is not haulted. I supose I could add a if winexists() in there to handle that, but I thought disabling UAC during this process would be a simpler task.

Why is toggleing UAC a bad idea if it is reverted back to the original state?

[LarryDalooza]

Setting changes without a reboot. What makes you say that?

If you bake a cake and put a sign up that says "Cake Baked"... could I put up a sign that says "Cake Baked" and my cake appears?

[kgreer]

that ananogy is not even a parelel to the issue being discussed and still does not answer the question programatically. If you state the script toggleing the UAC still requires a reboot, expain why? I tested this and UAC is off when the function is called and re-enabled when called again. I'm open to the possiblility I'm wrong but I wont take cake for an answer.

[LarryDalooza]

I have seen this subject many times. UAC is controlled via "EnableLUA" in the registry. This requires a reboot. Just setting the value changes nothing. Also, the setting "ConsentPromptBehaviorAdmin" does not disable UAC, but alters the behavior. Elevated actions still require an admin context. You can possibly avoid the "consent prompt" by setting this and using admin credentials via RunAs(), but you cannot disable UAC by just changing a registry setting and not changing the user context.

[Javik]

in one specific script I have I need to install network printers.

If you are using a Windows domain, you can install printers/drivers via group policy objects. These run with machine/admin level permissions and don't need elevation. They will also silently install printers during the boot process before the logon prompt appears.

[kgreer]

I am on a Windows domain, but I created a script for users to select their office and a list of printers shows up for them to pick and choose which ones need to be installed. I was hoping to get around the prompt "do you trust this printer" to make a little more user friendly.

[JLogan3o13]

More important than to reboot or not to reboot, is guinness' comment about the UAC being there for a reason. We're not in the habit of supplying ways to get around security. See bullet point 2 in the forum rules at the bottom-right of this page.

Edited January 31, 2013 by JLogan3o13

[JohnOne]

I have used a script found here to disable-enable UAC on this forum before now, and I'm pretty sure PC never needed to be rebooted. It did of course require to confirm via UAC to disable it.

I just cannot remember if it was the above script.

[Tripredacus]

I am on a Windows domain, but I created a script for users to select their office and a list of printers shows up for them to pick and choose which ones need to be installed. I was hoping to get around the prompt "do you trust this printer" to make a little more user friendly.

Why not use the domain to install the printer?http://technet.microsoft.com/en-us/library/cc722179%28v=ws.10%29.aspx

[kgreer]

because we do not use department specific printers and we allow users to print to any printer they can connect to on a given office print server. Users travel to other offices, and if a department moves to new location in a office, the printer does not. My script works great, its not a big deal that users have to click the "allow" button. the "do not show again" checkbox can be checked too.