Running unsigned software as a standard user

Posted by BWMerlin@reddit | sysadmin | View on Reddit | 19 comments

I am trying to allow standard users to run [ViPlex Express](https://novastar-store.com/download/#1626964971901-032d4090-12cd) (LED signage software) on our RDS server. Everytime ViPlex Express is launched the user is prompted for UAC as the software is from an unknown publisher. So far I have tried granting "everyone" FULL access to the bin directory in the install directory. I have tried [creating a scheduled task icon](https://www.sevenforums.com/tutorials/11949-elevated-program-shortcut-without-uac-prompt-create.html) which only works for myself. I have tried running [Standard User Analyzer](https://learn.microsoft.com/en-us/windows/deployment/planning/using-the-sua-tool) which doesn't detect any issues. I have tried running [Application Compatibility Toolkit](https://learn.microsoft.com/en-us/windows/deployment/planning/act-technical-reference) and making a shim but that doesn't work. I have reached out to the developer to see if they have a signed copy of ViPlex Express but I will not be holding my breath on getting a positive outcome from that enquiry. I would rather not disable UAC or make the user and admin but I do need some way for them to run this software. How do others run unsigned software for standard users?

Reply to Post

19 Comments

[-]

Sudsguts@reddit

Wow. It's a beauty. What about including it in DEP?

[-]

BWMerlin@reddit (OP)

DEP?

[-]

Sudsguts@reddit

Data Execution Prevention. Adv System Settings -> Performance -> Settings. Add the weird NEC executable in there.

[-]

BWMerlin@reddit (OP)

Thanks for this but unfortunately Windows will not allow it and gives the following warning message. >This program must run with data execution protection (DEP) enabled. You cannot turn off DEP for this program.

[-]

Sudsguts@reddit

Aside from the Scheduled Tasks thing - I've run out of ideas for this. well, no, I do: get a modern display system with web based updater.

[-]

BWMerlin@reddit (OP)

We have had other issues with this sign and the company we brought it through but unfortunately replacing it isn't currently an option. It maybe possible to replace the hardware that connects and controls the sign but that is a bit beyond me and I have precious little time to investigate alternatives.

[-]

Pilchards333@reddit

I can't offer a fix, but can sympathise, novastar software is pretty badly put together.

[-]

BWMerlin@reddit (OP)

Thanks, if I ever find a solution I will post. For now I am leaning towards installing ViPlex Express on the users device and making them local admin vs making them a local admin on the RDS.

[-]

sublimeinator@reddit

I'm with you on the local install and not RDS, but don't make their login a local admin, make a local account with admin rights that they launch the app with. Easier to manage/secure this way.

[-]

xCharg@reddit

If app requires admin - it requires admin. Signed or not - doesn't matter.

[-]

BWMerlin@reddit (OP)

Sure but making a shim using ACT should have resolved that issue should it not?

[-]

Jam_Pie_Cream@reddit

How does the software interact with the the sign controller ? Is it communication over USB / Ethernet/ HDMi/ RS232 connector ? The software not having a code singing certificate is concerning, and the privileges it's trying to elevate may be required to enact the communication method the RDS OS is detecting and blocking due to user access rights.

[-]

BWMerlin@reddit (OP)

There is a signage player device that is attached to our network (Ethernet with an IP address) and wired (not super sure the exact standard for this part) to the LED signs. This signage player is what controls the actual LED signs and AFAIK ViPlex Express simply allows you to programme playing images, schedules etc and pushing this down to the signage device. RDS is Windows Server 2022 Data centre.

[-]

disclosure5@reddit

> Everytime ViPlex Express is launched the user is prompted for UAC as the software is from an unknown publisher. UAC does not prompt "because it's unsigned". UAC prompts because the application wants administrative privileges - and even if the application was signed UAC would still prompt. You're only seeing the message about it being an unknown publisher because UAC prompts include the publisher name. > How do others run unsigned software for standard users? Can you get us a screenshot of the error? This might help us with whether it's actually UAC or, by the sounds of it, Smartscreen.

[-]

BWMerlin@reddit (OP)

 https://preview.redd.it/5bvw4nb34zza1.png?width=454&format=png&auto=webp&v=enabled&s=c4796eae7362305b6402dfe380e88e7dff9c52d7

[-]

disclosure5@reddit

Yep that's UAC, and you could test this theory by self signing the cert and finding that you still get prompted. If you go into the application properties does it have "always run as administrator" ticked or similar? Something somewhere is triggering the administrator prompt and usually the things you've tried already are the answer.

[-]

BWMerlin@reddit (OP)

If I check the compatibility options nothing (admin, previous version of Windows etc) has been enabled. When I tried making the shim and ran a test the test would work but after applying the shim it would still prompt for UAC.

[-]

frac6969@reddit

Have you tried just setting __COMPAT_LAYER to RunAsInvoker? Some programs just ask for admin but don’t actually need it.

[-]

BWMerlin@reddit (OP)

I have indeed.