Cannot run as local admin after windows update 22H2

FinalBuilder Discussion
,
1

I am using Finalbuilder to run some apps and scripts as the local administrator.
This works fine until I update my machine to WIn11 22H2
I just verified when I rolled back my VM to pre 22H2 the script runs fine again.
When the script fails it generates an authorization error

Could it be I have to change something in the local policy settings of my Development (virtual) Machine in order to allow running “as administrator” from within final builder script? Anyone knows where to look for this item?

Error:
Failed to execute program S:\Sources\bpl\22.0\Win32\PrepSGDevEnv.exe as user Administrator. Error : Toegang geweigerd

(Toegang Geweigerd == Access denied)

2

Hi Hans

I assume that S is a mapped network drive or an external drive?

Are you able to run the application from the command line (with or without using runas)? Is your action specifying any credentials (under execution properties on the runtime property page)?

Do you have the Windows Defender Device Guard feature enabled? We have had several issues caused by this feature introduced in 22h2.

3

Turns out Windows Defender Device Guard is enabled by default - takes registry changes to turn it off. We have it turned off as it was causing several issues - we’ll have to setup a test with this but I suspect this may well be the cause.

4

Hi every one reading this.

Indeed it took a registry change, see:

This worked for me:

go to HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>Current Version>Policies>System

Modify EnableLUA, change value from 1 to 0

(BTW: S: is a local drive in my VM, definitily not a network drive. S: stands for “sources” :wink: )

5

This is not a good idea, you are turning of UAC with that registry entry.

6

If you right click on FinalBuilder and select Run as Administrator then that will cause a UAC prompt, after that FinalBuilder should be able to run anything.

There is no way to programatically elevate a process that we can use. ShellExecute can do this, but it cannot capture stdout/stderr so there would be no way to log the process output.