[EDITING] UAC Override

Using Application Control Solution you can override UAC prompts for end-users. You can create custom messages that require users to submit a reason for requesting administrator rights, which replace UAC prompts for credentials. These reasons can then 1capture the reason and close the application, 2capture the reason and allow end users to automatically have administrator rights, or 3capture the reason and go through an approval process with the help desk. 

There are three custom messages (For details on how to create this custom message, go to [READY] Self-Elevation Without Adding Administrator Rights.)

[READY] Self-Elevation

[READY] Request Elevation

To override UAC prompts, do the following steps:

1. In the Security Manager Console, click the Policies tab.
2. In the file library in the left pane, navigate to Policies > Arellia Solutions > Application Control > Filters > Dynamic Filters > Environmental Variables. 
3. Right-click Environment Variables and click New > Environment Filter.
4. Give the filter a name, such as UAC Detected 
5. Set the variable name to __APPINFO_RUNADMIN with a value of 1
6. Set the Match Type to Partial
   
7. Save the filter
8. Navigate to Policies > Arellia Solutions > Application Control > Actions > Environment Variables 
9. Right-click Environmental Variables and select New > Set Environment Variable Action 
10. Give the action a name, such as Clear UAC dialog
11. Set the Environmental Variable name to "__APPINFO_RUNADMIN" and empty value
    
12. Save the action (this action is used to prevent the UAC prompt from showing)
13. Navigate to Policies > Arellia Solutions > Application Control > Policies 
14. Right-click Policies and select New > Blank Application Control Policy 
15. Set the application target to the new UAC detected filter from step 2
    1. Optionally you can change this so only certain applications or certain users will have the UAC prompt overridden
    
    
16. Under Exclude conditions add the Administrators filter to stop child processes (which inherit elevation) from triggering this policy
17. Click on the Application Actions tab and set the action to the Clear UAC dialog action from step 6
18. Also set the action to include one of the following:
    1. Add Administrator Rights, and Justify Application Elevation Dialog (will behave like [READY] Self-Elevation)
    2. Add Administrator Rights, and Justify Application Elevation (kill process) Dialog (will behave like [READY] Self-Elevation Without Adding Administrator Rights)
    3. Add Administrator Rights, and Approval Request Form Action (will behave like [READY] Request Elevation)
    
19. Save the policy and update the policies on an endpoint. Test the policy by right-clicking Command Prompt and selecting Run as administrator 
    
20. Instead of seeing UAC, you should see the custom message
    
21. The recorded response will then be sent to the Arellia Management Server where it can be reviewed by the help desk team.