User account privilege elevation

[MarkCallow]

My build needs software that is only available as a Windows .exe installer. My build script uses /VERYSILENT, etc. Installation and the installed software works fine on Appveyor CI. On GitHub Actions the software does not work. The install appears to succeed successfully but the software doesn't run correctly. The installer runs one of the package's .exe files that it installed and in Actions case that .exe is still running when I try to run the software. I am pretty sure the .exe is waiting for an answer to a UAC privilege elevation prompt. When I run my script locally, I get such a prompt.

How can I set the Windows policy on the runner to elevate without prompting? Presumably that is being set on Appveyor which is why I have no problem there. I can find no information about privilege elevation on either Appveyor or GitHub Actions.

[al-cheb]

UAC is disabled by default on Windows images.

[MarkCallow]

How do I enable it?

Oops! Misunderstood "disabled" in this context. When wrote the above I thought it meant obtaining elevated privileges was disabled. Now I think it means the UAC feature is disabled so there should be no prompt when a program requests admin privileges.

How can I check UAC really is disabled? I can see no other reason than awaiting a UAC prompt answer why the installer is not completing successfully on a GitHub Actions Windows VM but works fine on an Appveyor VM.

[al-cheb]

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4

0x00000000	This option allows the Consent Admin to perform an operation that requires elevation without consent or credentials.

runner-images/images/win/scripts/Installers/Initialize-VM.ps1

Line 29 in a64db79

Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 00000000 -Force

[al-cheb]

You can send me a link to software and I will check.

[MarkCallow]

You can send me a link to software and I will check.

I assume you mean the software I am trying to install. It is https://www.ssl.com/download/ssl-com-esigner-cka-1-0-3/. Unzip the installer and run it with "./SSL.COM eSigner CKA_$version.exe" /VERYSILENT. If using PowerShell, to make it wait for the installer to finish add | Out-Null. What I see in my builds is that a process started by the installer, eSignerCSP.Config, is still running when it exits, still running after a sleep 10, still running when the next step of my build runs and the step after that which then fails because of the incomplete installation.

Both the sites I found that gave instructions to modify HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System to stop the UAC prompting said you have to reboot the system for the changes to take effect. Is the VM rebooted after initialize-VM.ps1 is run?

[al-cheb]

PS > & "C:\Program Files (x86)\SSL Corp eSigner CKA\eSignerCSP.Config.exe"; gps eSignerCSP.Config

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
     41       3      436       2004       0.00   8520   2 eSignerCSP.Config

There is no eSignerCSP.Config process:

runs-on: windows-latest
    steps:
      - run: |
          curl.exe -sL "https://www.ssl.com/download/ssl-com-esigner-cka-1-0-3/" -o "ssl-com-esigner-cka-1-0-3.zip"
          7z e .\ssl-com-esigner-cka-1-0-3.zip
          & '.\SSL.COM eSigner CKA_1.0.3.exe' /VERYSILENT | Out-Null
      - run: Get-Process eSignerCSP.Config
      - run: |
          & "C:\Program Files (x86)\SSL Corp eSigner CKA\eSignerCKATool.exe"

[MarkCallow]

There is no eSignerCSP.Config process:

Hmm? That is very interesting. It is definitely there in my case. I have to figure out why.

Did you edit your reply above? The email notification I received about your comment showed the script searching for eSignerCSP.Config.exe.

Thanks for your help.

[MarkCallow]

I have been able to reproduce my issue locally where I can respond affirmatively to UAC elevation requests which confirms the issue is not related to UAC elevation. I have therefore marked @al-cheb's reply as the answer.

[t3chguy]

@MarkCallow I presume you were/are encountering a variant of https://github.com/vector-im/element-desktop/actions/runs/3968233264/jobs/6802172248#step:15:79

Did you ultimately get anywhere with this? 1 in about 20 runs successfully signs, the rest fail in an identical manner which I can reproduce in a Hyper-V locally.

[MarkCallow]

No I did not. My case is different than yours as you can see in this failed build. In my case the Windows certificate manager thinks I have no private key - which is supposed to be provided via the eSigner tool - so signtool can't find a certificate it can use.

We discovered, by way of receiving a large bill, that SSL charges a per-signing fee so management decided to look at other providers. We're still in that process. (SSL does have some packages that include a certain number if signings but they're quite pricey.)

[samus-aran]

We're locking this discussion because it has not had recent activity and/or other members have asked for more information to assist you but received no response. Thank you for helping us maintain a productive and tidy community for all our members.