1

Is there any way for a user to interact with a uac prompt for admin privileges despite not being not able to use a physical keyboard, mouse or foot pedal? I use both voice and eyetracker software, Dragon naturally speaking and Optikey,but neither can interact with uac, AFAIK. One workaround, that I use is using something like Teamviewer to interact with the uac prompt. This is not ideal, as it requires a second accessible computer. Is there another approach that obviously doesn't need to disable uac either? Perhaps something like a physical key (e.g. Usb)?

migrated from security.stackexchange.com Aug 4 at 19:44

This question came from our site for information security professionals.

1

UAC (technically, consent.exe) is a high-privilege application (runs as LocalSystem), which by default prevents other applications (such as accessibility programs) from interfacing with it.

However, Microsoft is aware of this limitation, and created the "UIAccess" application property, which bypasses that limitation (if set to "true"), under the following conditions:

  1. The application is signed with a trusted signing key.
  2. The application is installed under the Program Files / Program Files (x86) directory, or in the System32 directory.

Dragon should fulfill all of these requirements, unless you installed it in a non-default location.

However, by default, UAC prompts also appear on a special "desktop" (not the same as the virtual desktops feature of Win10). This also prevents programs from interacting with the prompt. Therefore, you need to turn off the Secure Desktop for UAC prompts. There are two ways to do this:

  1. Search for "UAC" and open the "Change User Account Control settings" result, then move the slider down to the third position from the top (will say "Don't dim the desktop").
  2. Open the "Local Security Policy" management console (secpol.msc), then into "Local Policies" > "Security Options", and change the following settings:
    • "User Account Control: Behavior of the elevation prompt for Administrators in Admin Approval Mode" should be set to "Prompt for Consent". The default value might also work (with the next setting) but I'm not sure.
    • "User Account Control: Switch to the secure desktop when prompting for elevation" should be set to "Disabled".

At that point, accessibility tools - including eye trackers and dictation tools - should be able to interact with UAC prompts, if they were installed correctly.

  • Thank you. Removing screen dimming seems to have worked. Switching to secure desktop was already disabled, and behaviour of elevation prompt was set to "prompt for consent for non-windows binaries". I trust that this setting is okay? I did see "Allow UIAccess applications to prompt for elevation without using the secure desktop" set to disabled. Is this related to the first part of your answer? – codingApprentice Aug 6 at 19:02
  • The "Switch to secure desktop..." option is an override in that if it's enabled the secure desktop is always used, regardless of other settings. The screen dimming is the visual representation of the switch to the secure desktop. The "prompt for consent for non-Windows binaries" is much easier to bypass than the simple "prompt for consent" but generally OK if you aren't running sketchy programs. The "Allow UIAccess..." thing is usually not needed; it specifically allows accessibility programs (but not other things) to bypass the secure desktop when elevating. – CBHacking Aug 7 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.