21

Ever since the latest version of Windows 10 was installed (version 1511 Pro), I've been getting near constant UAC prompts from Exchange Activesync Policies Broker. It doesn't matter if I accept them or not, they keep coming back. I've also seen similarly constant prompts on my laptop from Networks, but that hasn't shown since I recently formatted and re-installed Windows 10.

I am not using Exchange Server. I only have IMAP accounts and one outlook.com account registered in Outlook 2016 which I believe uses EAS.

I'm not very worried about it being malicious, but its really starting to get on my nerves. I'd like to turn it off, but failing that, one would think that Microsoft would make their own software run silently if it is required.

For what its worth, I have Office 2016 installed.

A quick Google search returns only foreign language forum posts and garbage search sites like findeen.co.uk and 2search.pixub.com.

A more recent search has yielded the possibility that it may be related to Visual Studio, which I do have installed, but no possible fixes are offered that I can see.

I have tried the following:

  • Update Visual Studio 2015 to the latest revision
  • Checked to make sure that my Windows Account is active (OS is not requesting verification) (as per last post here)
  • This has to do with Outlook attempting to request permissions, to do something, that the Exchange Server you are connecting to is configured to allow. So what else was installed when installed the last cumulative Windows 10 patch? To determine which permission is triggering this request will require you to investigate what permissions you are allowing on the Exchange Server and not allowing on the client. – Ramhound Jul 21 '16 at 17:50
  • I can't submit an answer until I know more. I can't reproduce this behavior against my own Exchange Server and my desktop which has Office 2016 installed on it. I personally would just reset my EAS polciies on the machine as a very basic first step. – Ramhound Jul 21 '16 at 17:52
  • @Ramhound I am not connected to any exchange servers. I do have an outlook.com connection though, which I understand uses EAS, but no "Exchange" accounts. All other accounts are IMAP – agent154 Jul 21 '16 at 17:59
  • How do I reset Exchange ActiveSync policies applied to my Windows 8 machine for Exchange mailboxes I've since removed? for kicks and giggles, try resetting your EAS policies, it might be an Outlook.com configuration that just happen to go live when you last patched. You might also try allowing various permissions that EAS can be configured to allow. – Ramhound Jul 21 '16 at 18:02
  • 1
    I assume your domain Admin has looked into the group policies that might control this behavior? You using a domain account changes everything – Ramhound Jul 22 '16 at 11:34
10
+175

Exchange ActiveSync Policies Broker is the program that implements Exchange ActiveSync policies, which are a way for the administrators of large organizations to manage the security of devices that can access Exchange mailboxes.

It runs, presumably, to download and install the latest version of any ActiveSync policies. To implement some policies, it needs administrative access to the machine.

Normally, it's registered in UAC's COM auto-approval list, so it can be loaded via the Component Object Model without producing a UAC prompt. Assuming you haven't set UAC to the highest level, the Policies Broker should be auto-elevated if there's a REG_DWORD Registry entry called {C39FF590-56A6-4253-B66B-4119656D91B4} with the data of 1 here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UAC\COMAutoApprovalList

If that value is present and the prompts are still appearing, make sure that this key exists:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C39FF590-56A6-4253-B66B-4119656D91B4}\Elevation

Make sure it has a REG_DWORD entry called Enabled, set to 1. Further reading: The COM Elevation Moniker.

If the prompts continue to appear, make sure this key does not exist (note HKCU rather than HKLM):

HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{C39FF590-56A6-4253-B66B-4119656D91B4}

The presence of that key in a per-user (i.e. non-secure) location could conceivably make Windows think that this specific COM component shouldn't be allowed to automatically elevate.


Danger zone! I haven't tested this (since I can't reproduce the issue), but deleting the InProcServer32 and LocalServer32 keys under HKEY_CLASSES_ROOT\CLSID\{C39FF590-56A6-4253-B66B-4119656D91B4} has a very good chance of stopping that program from being run; it would simply stop that COM class from being instantiated. You'll have to adjust the permissions of the parent Registry key first, including changing its owner to Administrators rather than TrustedInstaller. If you're feeling particularly destructive, you could also delete EasPoliciesBrokerHost.exe and EasPoliciesBroker.dll from System32, since those are the files involved in that COM class. Again, this entire paragraph is dangerous and you should back things up before trying it. The rest of the answer is perfectly safe, though.

  • I do have UAC set to the highest setting, requiring that I enter my admin password for every task that requires elevation. – agent154 Jul 25 '16 at 14:18
  • If UAC is at the highest setting, elevating anything - including this COM control - will produce a UAC prompt. Does setting UAC to the default level remove the prompts? – Ben N Jul 25 '16 at 19:30
  • I expect that it would, but I also expect that I shouldn't get an elevation prompt for a system service such as this no matter what. This allows a user to prevent system policies from being applied. – agent154 Jul 25 '16 at 20:35
  • @agent154 Indeed, it doesn't seem like a good design to me either. Nevertheless, the highest UAC setting is designed to require elevation for any administrative operation started by a non-elevated process. – Ben N Jul 25 '16 at 20:36
  • Be aware: UAC fundamentally has only two settings: On and Off. In Vista the default setting was On. As of Windows 7 the default setting was changed to Off. This means that without a UAC prompt, you can become an Administrator, taking complete control of the PC, with UAC in Windows 7 default setting. If you care about security you should seriously consider turning UAC back On. – Ian Boyd Oct 28 '18 at 17:48
1

I was suddenly having this issue every 10-30 minutes even though I was not signed in using a Microsoft account and I had never opened the Mail app. After opening the Mail app to see if that was related I started receiving the UAC prompt every few seconds. I fixed this by uninstalling the Mail app as follows:

  1. Start PowerShell as an administrator
  2. Run the following command: Get-AppxPackage *microsoft.windowscommunicationsapps* | Remove-AppxPackage

Note: This also removes the calendar app.

0

It looks like you're using Microsoft Account to login to your Windows 10 PC. Try to switch from Microsoft Account to local account, it helped in my case. This won't break anything since you can add the Microsoft Account later for apps that require it.

  • That is also what caused this program to start running on my tablet, but you are providing a workaround, not a fix. – Ben Voigt Sep 7 '16 at 18:25
  • I just saw this prompt (and said no) after a long time that I have been using the Microsoft account. Wasn't doing anything at the moment, just using Edge browser with many tabs open, so I wonder if there's some exploit vector trying to do something via a webpage ad or something – George Birbilis Dec 21 '16 at 8:16
  • It also happens if you're logging into your PC not using a Microsoft Account (i.e. a Local account) – Ian Boyd Oct 28 '18 at 17:40
0

I tried all of the above steps and still had the pop-ups bothering every few minutes. Finally I got rid of it by removing my exchange account from the "Mail" app (in-built in Windows 10) and moving to Outlook.

protected by Community May 4 '18 at 6:02

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.