App Locker: admin user (non-admin token) unexpected run behavior

As an administrative user with a filtered token (not choosing Run As Admin), when I double-click an .exe residing in a location that no App Locker rule would allow a non-admin token to run - I expect to see the application blocked by App Locker, but it runs
instead.
Background:
No App Locker rule exists that would allow the .exe file's location (on my administrative user's desktop) or any of the other .exe's I'm able to run from my user's profile directory. I checked several of these with ProcExp and they all show
BUILTIN\Administrators = DENY on the security tab.
The only App Locker rule that would allow me to run this is the default rule for BUILTIN\Administrators.
I have verified with ProcExp that the current Explorer.exe is running with a filtered token (BUILTIN\Administrators is denied).
My administrative user is a member of a group, Workstation Local Admins, which is a member of BUILTIN\Administrators. I am not expecting this to match the Default rule for BUILTIN\Administrators.
UAC group policy is configured as follows and I have verified this policy is applied to this system and registry keys have been set to match by group policy processing: ENABLED -> [Admin Approval Mode, Only elevate UIAccess applications...secure locations,
Run all administrators in Admin Approval Mode, Switch to secure desktop when prompting..., Virtualize file and registry write failures...]; DISABLED -> [Allow UIAccess applications to prompt...without using the secure desktop, Detect application installs...,
Only elevate executables...signed and validated]; PROMPT FOR CONSENT -> [Behavior of the elevation prompt for administrators..., Behavior of elevation prompt for standard users]
AppIDSvc is running and seems healthy
all rules categories are set to enforce
So what is going on here? App Locker event log happily reports that all these "were allowed to run" - but how are the rules evaluating to allow them to run?
born to learn!

> Admin), when I double-click an .exe residing in a location that no App
> Locker rule would allow a non-admin token to run - I expect to see the
> application blocked by App Locker, but it runs instead.
This guy experienced the same issue:
http://superuser.com/questions/744350/applocker-and-uac-on-windows-8-1
Seems to be a design change in W8, although I couldn't find any
information about it...
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Similar Messages

CVC Locked by User message during DP macro run in process chain

Hi Gurus,
During the process chain for macro run the following are the observations:
(a) DP Background Macro is part of a long process chain containing many other steps.
(b) Out of 10000 CVC's executed only 2000 CVC's give error in the job log " The selected data is locked by user XXXX"
(c) The process chain is delivered successful ie green, it ignores the wrong 2000 CVCs which are locked.
(d) The same job when triggered in background as standalone runs successful and does not show any error in the job log as well. All fine.
(e) The CVC's are mutually exclusive, so do not conflict with any parallel job.
Would appreciate if someone has come across such a situation and can suggest actions.
Regards,
PK

Hi Folks,
During the process chain for macro run the following are the observations:
(a) DP Background Macro is part of a long process chain containing many other steps.
(b) Out of 10000 CVC's executed only 2000 CVC's give error in the job log " The selected data is locked by user BATCHAPO"
(c) The process chain is delivered successful ie green, it ignores the errors 2000 CVCs which are locked.
(d) The same job when triggered in background as standalone runs successful and does not show any error in the job log as well. All fine.
(e) The CVC's are mutually exclusive, so do not conflict with any parallel job.
Would appreciate if someone has come across such a situation and can suggest actions.
Regards,
PK

Air App will not read local text file using openAsync/readUTFBytes on user (non-admin) mode

I am running an Air App I did for the desktop, from the actual installed executable already deployed in the machine (Not from Flash Pro / Flex dev. environment). For some reason the app will not read a text file stored in the same application folder unless I run my app as administrator from the OS.
When I run the app as admin, or within the development environment it works fine. Maybe this is related to some security issue? I read the adobe air documentation, and this should work...
I am using openAsync/readUTFBytes on user as shown here:
var continueGamesConnection:FileStream();
var continueFile:File = new File(File.applicationDirectory.resolvePath("continueGames.txt").nativePath.toString());
continueGamesConnection.addEventListener(Event.COMPLETE, openSavedGames);
continueGamesConnection.openAsync(continueFile, FileMode.UPDATE);
function openSavedGames(event:Event):void
     continueGamesConnection.removeEventListener(Event.COMPLETE, openSavedGames);
     var content:URLVariables = new URLVariables();
     var loadedContent:String = new String();
     loadedContent = continueGamesConnection.readUTFBytes(continueGamesConnection.bytesAvailable);
     content.decode(loadedContent);
     variableX = content. variableX
     //etc, etc.
     continueGamesConnection.close();
By the way, I have also, tried using FileMode.READ, and others, and it still gives me the same problem. Only works if ran on admin mode or from the dev. environment.
It's very frustrating, I tried reading other posts without any luck... What solutions do people use for this kind of problem?
I have seen that you can set the app to run as admin somehow, and I guess that could work. However, this should work just fine, since it doesn't seem to violate any of the security APIs of Air. Seems like an overkill. But even so, how do I do that?
You help is greatly appreciated!

Thanks kglad.com. I will try this and see if it works. Can you check my code a bit to see if it's right?
var continueFile:File = new File(File.applicationStorageDirectory.resolvePath("savedgames/continueGames.txt").nativePath.toString());
Does this look right to work across all desktop OS?

Adding a domain user to the admin role within the local user management breaks all metro apps for all users!!

Hi,
I have posted this in another large thread under the "Windows 8 General" group but have not had any appropriate feedback from MS.
After hours of testing and working with other users I have managed to isolate a simple situation that breaks all metro ui applications within Windows 8 for all users on the machine. Here are my exact steps and notes.
Before continuing if you are running Avast then your solution may be to turn of the behaviour shield functionality as this also breaks metro apps. This is NOT the problem we are having!
I have performed 3 cleans installs after isolating the problem and am able to reproduce the issue every time using the same steps on two different machines.
First thing to say is that for us it has nothing to do with simply joining the domain, domain/group policies nor does it appear to have anything to do with the software we installed, the problem here is much more simple but the result is pretty terrible.
Here are my exact steps of what I did to reproduce our problem:
Complete format of HDD in preperation for a clean install
Clean install performed
Set up the machine initially with a local account
Test metro apps - all working fine
Open control panel from the desktop, click on System, change the system to join the domain, click reboot
Log into the system using my domain account
Test metro apps - all working fine
Here's were the problem starts. I need my domain account to have admin rights on the local machine so I can install programs without the IT men having to come over and enter their password every 5 mins.
I go to control panel via the desktop and click on User Accounts. From with here I then click on "Manage User Accounts". This requires the IT guys to enter their details to give me access to such functionality. This is fine
In the dialog box that opens I can only see the local user that was initially created during setup. The "Group" for this local account shows as "Administrators" - Image included below (important to note that metro apps are working at this point)
I click add and then add my domain account - also giving it administrator access
Sign off or reboot to ensure the new security is applied
Sign back in to the domain account
Test metro - ALL BROKEN
Sign out
Sign in as local account
Test Metro - NOW ALL BROKEN FOR THIS USER ALSO
So as soon as I add my domain account to the local user accounts and set it as admin it breaks all metro apps for all users. This is on a totally clean install with nothing at all installed other than the OS.
Annoyingly if I go back and change the domain account to a standard user or if I totally remove the domain account from the local account management system the problem does not go away for either user. basically it is now permanently broken. The only fix I
could fathom was a full re install and not giving the domain user admin access to the local machine.
Screen one - this is the local user accounts window AFTER joining the domain and logging in with my domain account (All metro apps working at this point)
Screen 2: User accounts AFTER joining the domain and AFTER adding domain account to local user management (METRO BROKEN)
I have isolated my machine from all group policies so nothing like that is affecting me. Users I have spoken to in different companies have policies that automatically add users to the local user management. This means that metro apps break as
soon as they join the domain which leads them to wrongly think it is group policies causing the error. Once they isolate themselves from this they can reproduce following my steps.
Thanks

Hi Juke,
Thank you for the response and apologies for the delay in getting back to you. My machine was running a long task so I couldn't try your suggested solution.
I had already tried running the registry merge suggested at the top of the thread to no avail. I had not tried deleting the OLE key totally so I did that and the problem still exists. I will post all the errors I see in event viewer below. For
your info, since posting my initial comment I have sent out my steps to 7 different people and we can all reproduce the problem. This comes to 10 different machines (3 of them mine then the other guys) in 3 different businesses / domains. We see the same errors
in event viewer.
Under "Windows Logs" --> "Application" : I get two separate error events the first reads "Activation of app winstore_cw5n1h2txyewy!Windows.Store failed with error: The app didn't start. See the Microsoft-Windows-TWinUI/Operational log for additional
information." The second arrives in the log about 15 seconds after the first and reads "App winstore_cw5n1h2txyewy!Windows.Store did not launch within its allotted time."
Under "Windows Logs" --> "System" : I get one error that reads "The server Windows.Store did not register with DCOM within the required timeout."
Under "Applications And Services Logs" --> "Microsoft" --> "Windows" --> "Apps" --> "Microsoft-Windows-TWinUI/Operational" : I get one error that reads "Activation of the app winstore_cw5n1h2txyewy!Windows.Store for the
Windows.Launch contract failed with error: The app didn't start."
If you require any further information just let me know and I will provide as much as I can.
Thanks

Calendar Notification + Google Apps + Super Admin + Macs + Notifications

Background: I’m a Google Apps Super Admin which means that I have access to almost everything, including everyone’s calendar. They show up under “My Calendar”
Issue: I have a few users under our account. ALL of their calendar’s show up on my account (it’s a super admin thing, cant be removed because that’s the way it is). My problem is that, I get notification for EVERYONE, for every event… because as far as the system is concerned, ALL of their calendars are my calendar. This is specifically annoying because every 15/30 mins or hour I get everyone’s notifications on my iPhone, mac, etc.
No I don’t want to set up another account and set them as admin, it causes too much confusion.
Please reply if you actually know about resolutions rather than speculations. I’ve had many threads where it went on forever because everyone thought they were an expert (I say this with totally respect).

This may give you results you seek - if you mainly just want the alerts to stop on your iOS devices
http://n8henrie.com/2012/12/google-calendar-delegates-and-mountain-lion-calendar /
I'm also a gApps admin and have had similar issues. USUALLY, I could simply uncheck co-workers calendar listed in 'My Calendars' or 'Other Calendars' ( yes, they can appear in either place, don't ask, it's a Google Admin stupidity) to hide their schedule from my calendar. USUALLY, if i didn't see their schedule, I wouldn't see any alerts on my iOS hardware.
BUT. One colleague kept showing up no matter what.
I noticed most alerts I saw were invites, awaiting for me to accept (although I obviously was NOT) so I've tried the following on my iPhone (iOS 7)
Go into Settings > Mail, Contacts, Calendars
(scroll down to Calendars section at bottom)
Turn OFF New Invitation Alerts
Your mileage my vary.
I finally decided I don't typically need my co-workers schedule on my iPhone, so I went nuclear and went to my Google – iPhone/iPad calDav settings found at this Link: https://www.google.com/calendar/syncselect and turned off ALL of my co-worker calendar calDav syncing.
If you DO occasionally need to look at your co-workers schedules, use the iOS google calendar Web App:
Visit your Google Apps using Safari on your iPhone, iPad, etc.
Go to the Calendar and
Add it as a Web App to your iDevice (http://blog.blueleaf.com/how-to-save-your-favorite-website-as-an-iphone-app-vide o/)
Now when you need to check co-workers schedules – launch your new gCal webApp and scroll to the bottom, click the settings button to choose which co-worker schedule you want to view, save and voila.
Hope this helps.

Errors in file /u01/app/oracle/admin/bdump/orcl_lgwr_413700.tr

why i have this error?
Errors in file /u01/app/oracle/admin/bdump/orcl_lgwr_413700.trc:
ORA-00321: log 1 of thread 1, cannot update log file header
ORA-00312: online log 1 thread 1: 'oradata/redo01a.log'
give solution?

would you please paste the result here for the following query
SQL> select a.group#,a.thread#,a.sequence#,a.members,a.status,b.member
2 from v$log a,v$logfile b
3 where a.group# = b.group#
4 /Khurram

Hostname mismatch - Server.app/Server Admin

Hi All,
I have a strange one here. I seem to have a "mismatch" in hostname between Server.app & Server Admin - this also seems to be causing issues with SSL which is calling out a "hostname mismatch" between the SSL certificate and the server using the certificate (because it believes the server names don't match).
Server.app - says hostname is srvmacmini.yourdomain.net.au (correct config)
Server Admin says hostname srvmacmini-yourdomain-net-au.local (note the inserted "-" and .local)
Computer name is set to srvmacmini
Using the terminal - hostname is srvmacmini.yourdomain.net.au
DNS still seems to be working ok with all names resolving as expected - srvmacmini.yourdomain.net.au
I have tried to reset the entry in Server Admin to match the entry in Server.app - however it won't let me update the entry for some reason.
Would really appreciate someones insight on this.
Finally - a complaint/rant - I frankly don't know why Apple cannot develop a SINGLE and efficient admin interface, this current mashup of tools where your switching between Server.App, Server Admin, Workgroup and then Profile Manager and everything else is frankly not efficient and leads to issues as described above in my view. No point having two GUI's to managed the same set of config values.

Try this solution: http://support.apple.com/kb/TS3960?locale=en_US
It says:
Resolution
To check if servermgrd is loaded, see the output of this command in Terminal:
sudo launchctl list | grep -q com.apple.servermgrd && echo loaded || echo not loaded
If the output is "not loaded", load the com.apple.servermgrd job into launchd with this command:
sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.servermgrd.plist
Hope this helps.

Non-SysAdmins get error 18456 Severity 14 State 11 Login Failed for user _ Reason Token-based server access validation failed with an infrastructure error.

I have a SQL 2008 R2 system (10.50.4000) where I'm having problems connecting any user that is not a SysAdmin. Example: I setup a new SQL Login to use Windows Authentication and grant that user db_datareader on the target database. The user attempts
to connect using Excel client or Access or SQL Management Studio and receives Error 18456. The SQL Server Logs shows Error 18456 Severity 14 State 11 Login Failed for user _ Reason Token-based server access validation failed with an infrastructure error.
The strange part is that if I temporarily grant the user the sysadmin server role then the user can connect successfully and retrieve data. But, if I take away that sysadmin server role then the user can no longer connect but again receives the Error
18456 Severity 14 State 11 Login Failed for user _ Reason Token-based server access validation failed with an infrastructure error.
We've turned off UAC on the client machine to see if that was the problem, but no change.
I have dropped and re-added the user's SQL Login (and the related database user login info). No success.
The Ring Buffers output shows:
The Calling API Name: LookupAccountSidInternal
API Name: LookupAccountSid
Error Code: 0x534
Thanks for any help.
-Walt

Yes, you understand correctly. The user is logging onto a workstation (not the server) with a Windows Authenticated id. The user is using either Excel or Access or SSMS and connecting to the server using a Windows Authenticated SQL Login account.
If the account has sysadmin role (which is only for testing) then the connection is successful. If I take away sysadmin role from the account then the connection is unsuccessful and the SQL Server Log shows Error
18456 Severity 14 State 11 Login Failed for user _ Reason Token-based server access validation failed with an infrastructure error.
(SQL Authentication is not an option here. I must use Windows Authentication).
Any other troubleshooting assistance you can offer would be appreciated. Thanks.
-Walt

Can the Admin Tool be run as a standalone app?

Can the Admin Tool run without logging into a Dispatch Workstation?

Yes it can.
In fact you actually side step licensing issues by doing this because "technically" you are
not running a dispatcher workstation and therefore don't need to pay for another license.
The file to run is usually located in: DispatchStation\AdminTools and is called: ResourceManager.exe
You would need to take EVERYTHING from the AdminTools directory to run the tool.
You'd also want to make sure that the config file: ResourceManager.exe.config still makes
sense for the machine that you are on.
One word of caution: Running the Admin tool stand-alone is not really encouraged. Not a lot
of testing has been done in this regard and you may run into issues that have not been
seen when the admin tool is run as part of the dispatcher workstation.
I'm not sure if the stand-alone admin tool is even officially supported.
I CAN say that much of the functionality that you see from the too when it is run as part of the DW
does work when it is stand-alone, just don't expect 100%.

Access to my Office 365 third-party app for external user : "a User account is not registered for the account"

In my third-party web application of Office 365, I want to have access to the contacts, events and emails of all the users from the organizations who installed my app. The thing is I don't want that all these users have to grant me access, I just want one
admin of the org to grant access for my app and then be able to retrieve the data I need for all the users.
To test for one organization, I logged in as the admin and proceed to the Oauth2 authentication to retrieve the access token and in the first request (the GET one to retrieve an authorization code) i add the parameter
prompt=admin_consent.
With this access token, I can access the data (emails, contact, event) of the admin
for instance for the contacts
uri: https://outlook.office365.com/ews/odata/Users(adminemail)/Contacts
but not the data of the other users of this org with this uri
uri: https://outlook.office365.com/ews/odata/Users(useremail)/Contacts
The only thing I can do is retrieve an access token for each user but it supposed that each user has to authorize the access to the app but it's very cumbersome. So, i don't see what enables the parameter prompt=admin_consent and how to use it. Does anybody
know what it does?
And my question is: how can I do to access the data of all the users of one organization when the access has been granted by one admin?
Thank you!

This was answered on StackOverflow by Dushyant Gill. http://stackoverflow.com/questions/25316175/access-to-my-office-365-third-party-app-for-external-user-a-user-account-is-n/25316678#25316678
You are sending the OAuth request to a tenant specific endpoint of Azure AD. Note the {key_provided} part of your Url - that part represents the tenantid or a registered domain name of an Azure AD tenant. Azure AD throws this error is the user signing in
is not a user in that tenant.
Multi-tenant applications like yours have two options:
Perform home realm discovery yourself and send the SSO request to the correct tenant-specific endpoint of Azure AD: when a new Azure AD organization signs-up for your application, record its tenant ID, and registered domain names. On your login page, ask
the user for their email and try to discover what Org they belong to using the suffix the email.
Use the common endpoint of Azure AD. Instead of the {key_provided} part of the URL, use 'common'. In this case Azure AD will determine the user's tenant and sign-in the user. The token that your application will receive will still be from the user's tenant
(iss claim).
2 is more convenient for apps. However #1 has an advantage when the user's Organization has customized their sign-in page with the company logo etc - in the case of #1 the user will directly be taken to the customized and familiar sign-in page.
I recommend a combination of the two: try determining the user's organization and sending them to the tenant specific SSO endpoint. If you're not able to - send them to the common endpoint.

Any way to remove all "apps" for all users?`

I get that the new start menu is a compromise, and it's neat that it's "back."
What I'm not clear on, is if it's possible to remove/hide the "apps" for all users.
I'm not keen on having all users have all of these, especially in a corporate environment.
Would be preferable to have none, except for perhaps what's "allowed" by admins.
Standard office users, power users, devs, artists, accountants, most folks at work simply don't have a use for most of these apps. I also don't want bandwidth constantly being used by any of the live tiles. If a user wants to know the weather, they can go to
weather.com. If they want news, this is also available via any number of sites.
The other compromise of having apps "windowed" is also nice, but for an office environment, I just don't see people firing up a sandboxed calculator app (or, any of the other built-in ones).
Sorry, but honestly, I'd honestly just like to know if it's possible to set up a GPO, or use some other method to get the "apps" out of the way of the "standard office user."

Hi techresource0,
Use export-startlayout cmdlet to export the start menu configuration first:
Export-StartLayout
http://technet.microsoft.com/en-us/library/dn283401.aspx
Windows 10 Technical Preview has a new policy under start menu and taskbar:
Meanwhile, I have two thoughts on this if you are planning your environment:
One: a customized image.
Two: customize default profile.
For the first thought, you can uninstall all provisioned windows store app and then deploy this image to your environment. Of course, you can do this in an online system as well.
Removing Windows 8.1 Built-in Applications
http://blogs.technet.com/b/deploymentguys/archive/2013/10/21/removing-windows-8-1-built-in-applications.aspx
For second thought, you may prepare default profile, it would always copy to new created user profile:
Customize the default local user profile when preparing an image of Windows
http://support.microsoft.com/kb/973289
Alex Zhao
TechNet Community Support

Prime Infrastructure 2.1 - User add failed : Some unexpected internal error has occurred.

Setting up Prime Infrastructure to manage 2504 WLC, trying to add Lobby Ambassador and I get this error message:
User add failed : Some unexpected internal error has occurred. If the problem persists please report to the Tech Support.
Technically, this is my second attempt at setting up PI. I set it up initially with the wrong version of PI and created a lobby ambassador. I followed the instructions from the forum with a similar problem that said to remove the trap receiver on the WLC from my first attempt at installing PI.
https://supportforums.cisco.com/discussion/11110686/failed-add-device-wcs-reason-common-1-some-unexpected-internal-error-has-occured
I'm now able to add a Lobby Ambassador as long as its not the same username that I created on the previous PI setup. So I suspect this Lobby Ambassador username is somewhere on the 2504 WLC, but I can't find it anywhere to remove it.

I have just been struggling with a similar issue on a fresh install of Prime 2.1 Upgraded to 2.1.1.
If I try to create the user with lobby ambassador role it just fails with "unexpected internal error".
I eventually found that by creating the user as a normal admin user first - the user is added. You can then go in a remove the admin role and change the role to lobby ambassador. This works with no internal error and the lobby admin user is working fine.
I would say it is just a bug.

Configuration locked by user in fusion middleware enterprise obiee 11g

Hi All,
one of my team member locked the configuration and forgot to release the lock.when i login to the fusion middleware i m getting warning configuration locked by User.
Please help me to solve the issue.
Reply ASAP.
Thanks and Regards
Kiran.

I have cleared the tmp Folder under the Admin Server Directory and restarted the server..but still facing the same error..How to resolve the error *"oracle.adf.share.security.authentication.AuthenticationServlet"*

Lock OBIEE User

Hi,
I have some questions about locking OBIEE user (native user):
1. Can we lock OBIEE user from the admin tool or from other place? Usually, if I don't want a user to log in, I have to delete that user.
2. Can we set that when a user enter 3 consecutive incorrect password, then the account is locked automatically (like the one in the Oracle database).
Thank you very much for the help.

Some people have posted some helpful answers but they have not answered your questions.
1. No, you can't lock a user in the RPD. The best you could do is to change the user's password which you could script via UDML.
2. This is not possible in the current version.

Locking a user after unsuccessful login attempts?!

Does anybody know how to automatically lock a user after a given number of unsuccessful login attempts?
I noticed that solaris does not offer any security feature concerning this item, although it is a good opportunity for hackers to scan a solaris machine.
Please let me know
Thanx in advance

Hi,
The Trusted Solaris version supports this feature. You can find the detail about configuring the same at http://docs.sun.com under Trusted Solaris 8 and Administration Procedures.
The same can also be achieved by using Pluggable Authentication Modules(PAM) which has been incorporated since Solaris 2.6. For more info on PAM check out www.sun.com/solaris/pam. There some white papers and admin guide .Also refer to man pages on pam.conf ,pam and pam_unix.
Regards
Anshul

App Locker: admin user (non-admin token) unexpected run behavior

Similar Messages

Maybe you are looking for