We have about 15-20 users who have this software installed.
We have UAC enabled through GPO as you should, which means the software prompts for admin approval if a standard user trys to install it. Thats fine, they can call the help desk to have the software installed.
My problem is, our help desk is being bombarded every day because users can't update the software and there are updates almost every day which is prompting UAC.
Using procmon.exe to find out where it was trying to write to, I then created a GPO to allow file permission access to the program files folder for this particular software, including the program data folder, but it still prompts for admin approval. It seems as though that the software is using msiexec.exe to run a .msp patch file.
The only "ACCESS DENIED"s I can still see in procmon is things like this:
What can I possibly do to stop this software from prompting UAC with admin password credentials aside from disabling UAC?
Best Answer
Unfortunately this problem of inconvenience is not easily solved, as you're really talking about misbehaving software -- not meant for the enterprise environment where workstations are locked down. You will need to choose software that can run without aggressively applying patches, then you can manage the schedule and push them out yourself after having signed them. This is why systems administrators avoid consumer-grade software that tries to update often.