UAC Override

Arellia Application Control Solution can be used to override UAC prompts for end-users. This means that instead of end-users seeing a UAC prompt prompting for credentials, they can see a custom message asking them to provide a reason for why they need administrator rights. These reasons can then capture the reason and close the application, capture the reason and allow end users to automatically have administrator rights, or capture the reason and go through an approval process with the help desk. 

Steps

1. Navigate to Policies > Arellia Solutions > Application Control > Filters > Dynamic Filters > Environmental Variables 
2. Right-click Environment Variables and select New > Environment Filter 
3. Give the filter a name, such as UAC Detected 
4. Set the variable name to __APPINFO_RUNADMIN with a value of 1
5. Set the Match Type to Partial
   
6. Save the filter
7. Navigate to Policies > Arellia Solutions > Application Control > Actions > Environment Variables 
8. Right-click Environmental Variables and select New > Set Environment Variable Action 
9. Give the action a name, such as Clear UAC dialog
10. Set the Environmental Variable name to "__APPINFO_RUNADMIN" and empty value
    
11. Save the action (this action is used to prevent the UAC prompt from showing)
12. Navigate to Policies > Arellia Solutions > Application Control > Policies 
13. Right-click Policies and select New > Blank Application Control Policy 
14. Set the application target to the new UAC detected filter from step 2
    1. Optionally you can change this so only certain applications or certain users will have the UAC prompt overridden
    
    
15. Under Exclude conditions add the Administrators filter to stop child processes (which inherit elevation) from triggering this policy
16. Click on the Application Actions tab and set the action to the Clear UAC dialog action from step 6
17. Also set the action to include one of the following:
    1. Add Administrator Rights, and Justify Application Elevation Dialog (will behave like [READY] Self-Elevation)
    2. Add Administrator Rights, and Justify Application Elevation (kill process) Dialog (will behave like [READY] Self-Elevation Without Adding Administrator Rights)
    3. Add Administrator Rights, and Approval Request Form Action (will behave like [READY] Request Elevation)
    
18. Save the policy and update the policies on an endpoint. Test the policy by right-clicking Command Prompt and selecting Run as administrator 
    
19. Instead of seeing UAC, you should see the custom message
    
20. The recorded response will then be sent to the Arellia Management Server where it can be reviewed by the help desk team.