B&R 10 and UAC on Vista x64

Howard Gyton wrote:

Everything is working great and I love the new bootable Agent, except every time I log in I get two UAC prompts for elevation. One for TimounterMonitor.exe and another for elevation_app.exe.

Are you actually getting two prompts (one right after the other)? I have B&R 10 Standard Workstation on Vista Home Premium 32-bit and it shows the "elevation_app.exe" UAC prompt, but the other one shows up in the system tray as blocked and I have to enable it and then I get the prompt. This is on boot-up, though, as I don't usually log off and back on.

The quick solution provided by Acronis was to disable UAC. I also don't wish to do that. UAC is a standard function of Vista (and Windows 7) and it should work with it. I've included this problem along with some others submitted to support, but I haven't received any answers yet -- just requests for more information (which has also been submitted).

Yes, two prompts. The first for TimounterMonitor and the other is the elevation app. Echo Workstation did not work in this manner, even with UAC enabled.

I have the same exact problem on my Vista Home Premium 64-bit PC and have given the following information to Acronis. See also below this for possible solutions:
.… Every time I reboot or re-logon, Windows Vista (Home Premium 64-bit) gives me three messages that require my input. The first two messages are; "A program needs your permission to continue." Vista is requiring me to "OK" the running of two Acronis B&R 10 files. They are; "TimeoutMonitor.exe", located in C:\Program Files (x86)\Common Files\Acronis\Timounter, AND, "Elevation_app.exe", located in C:\Program Files (x86\Acronis\BackupAndRecoveryConsole. "Elevation_app.exe" is also being requested to be "OKed" whenever I start Acronis. The third file is intercepted by Vista with a System Tray hook which pops up and reads, "Windows has blocked some startup programs", which refers to "Schedhlp.exe", Located in C:\Program Files (x86)\Common Files\Acronis\Schedule2. I always give my permission and the programs seem to run just fine. But, I really find this annoying. Unfortunately, secpol.msc is not available in Windows Vista Home Premium. It is only available in Ultimate or better versions. So, I can't edit group policies very easily, and only in a limited way, using the registry. Can you help me with this problem? I have already tried HKLM\software\Microsoft\Windows\CurrentVersion\Policies\System to change "ConsentPromptBehaviorAdmin". But, although that prevents UAC from requesting the first two programs from requesting elevation, it also seems to turn off UAC completely, which I do not want to do. I have also tried setting the programs to run as Administrator for ALL users by right-clicking on the programs and choosing to run them as administrator, but that has had no effect. Running them in compatibility mode as an XP SP2 program does nothing also. As for the "blocked" program, the only solution I could find on the web would be to remove it from the registry's "RUN" section and use Windows Task Scheduler to run it. But, I don't think I should have to do that. I think this program that I paid a lot of money for should work properly, and if not, Acronis should provide me with a fix for this. By the way, in your knowledge base article, number 2955, you imply access to Local Users and Groups policy, but if the person has Vista Home Premium, like I have, they will not have access to Local Users and Groups or any group policy, because secpol.msc and other such editors have been removed from this version of Vista, along with other non-Ultimate versions. I did read somewhere that if these programs where written correctly, they would have a manifest that would automatically have Vista elevate them to run without prompting. I have even tried to set permissions on these files to "Full" for "Everyone", just to see if it would help, but it did not….

I submitted this to Acronis as a case within the last 24 hours and have yet to hear from them.

For the first problem about the two programs that require elevation, check out the following:
http://www.vistax64.com/tutorials/80938-user-account-control-uac-elevat…
http://www.symantec.com/norton/theme.jsp?themeid=labs_uac&header=0&dept…

A simple and good solution, however, is “TweakUAC” here:
http://www.tweak-uac.com/home/

For the other problem, see below:
On the Internet, I found this solution to the blocked “SChedhlp.exe” program, but I have not tested it. There is a program that automates the “unblocking” of “blocked programs, which does the work shown below, for you; it is at:
http://www.jimmah.com/vista/applications/startupunblocker_landing.aspx , but, I tried it and it does NOT show the drop down to “Run as admin”, but, rather, only “don’t run”, which won’t help the situation:

Here is the manual way of doing it:

Vista Blocked Programs at Startup- Fix Once and for All
________________________________________
I have the VISTA HOME Premium and like the VISTA Basic I do not have Security Policy Control on my non-VISTA Apps. If you have Windows Vista Ultimate then you do. So here is a way too once and for all to fix that VISTA tray BLOCKED APP alert that is quite annoying in that you are alerted with every bootup that your app is blocked and you must allow the app to run each time by giving VISTA permission blessing. Boo on that. So here is the fix:

Remove the startup app that is offending by:

Start----Run----and type in msconfig.exe

Go to STARTUP Tab and remove the app that is blocked by Vista noting on a sheet of paper where the program is run from. If the program app is run from the startup menu, then just go to Start---All Program Files---Startup Folder and remove the app there.

After removing the app, create a app Task using the Task Schedule with full VISTA blessed permission by following the instructions below:

1. Launch the Task Scheduler
Example: Start Menu → All Programs → Accessories → System Tools

2. From the Actions panel on the right, select Create Task...
a. Give the app a name of your choice in the "Name Section"

3. Go to the Security Options on the General tab
a. Select an user account with administrative privileges
b. Select the radio button Run only when user is logged on
c. Check the box Run with highest privileges

4.Go to the Triggers tab and click New...
a. In Begin the task, select At log on
b. In the Settings options, select All users
c. In the Advanced Settings options, check the box Enabled
d. Click OK to close the dialog

5. Go to the Actions tab and click New...
a. For Action, select Start a program
b. In the Settings options, browse for the Program/Script you want to execute on
startup
c. Click OK to close the dialog

6. Go to the Settings tab
a. Check the box Run task as soon as possible after a scheduled start is missed
b. Uncheck the box Stop the task if it runs longer than

7. Make any other desired settings

8. Click OK to save and close the task properties

What this will now accomplish is that once and for all your non-VISTA apps will run at windows startup with full permission and therefore the blocked programs alert on the bottom right tray of the desktop will disappear for ever (Vista is happy).

NOTE: If you have an app that reappears in the STARTUP in MSCONFIG...you will need to uncheck in the application itself to stop running at startup. VISTA will give that blocked message if you don't stop it from running at startup as a non-vista app. What our aim is to stop the program from loading at startup and run the program through the TASK Scheduler with full Vista blessing (the workaround).
End

On another note, if you have Vista Home Premium, or something other than Ultimate, then you don’t have Microsoft’s “polsec.msc” policy editor. (And, even if you import it from Ultimate, it doesn’t work.) So, short of finding everything hidden away in the Windows Registry, then only way to do it is with a third party policy editor. I have only tried “polseditx64.exe” by http://polsedit.southsoftware.com/, and I found that it only shows a few keys, and not the ones I need.

As a final note, I don’t want to have to use any of the solutions mentioned above for two reasons:

First, I have purchased, and am waiting for, Windows 7, which I plan to upgrade to in October, and I don’t want to have to deal with what will happen if I try to upgrade Vista with some hacks still installed to make Acronis work.

Second, I have already done many hours of work and research on this problem, which Acronis personnel should be doing, not me. Acronis has all the information to come up with a good solution which will not affect all the other programs on my system or my OS itself. Such a “Solution” is not acceptable. They could always re-write the programs with proper manifests, etc, and get them to elevate themselves, as they should. Or, they could make them install and run as services, or something. Once they fix this problem, all I should have to do is download and install a patch. I shouldn’t have to spend hours fiddling with my system and changing it so that Acronis works, but everything else is compromised in some way. So, I will wait and see what Acronis comes up with. Hopefully, they will fix this soon!
I would appreciate and welcome any feedback.
Thanks,
Dan

Hello all,

Thank you for using [[http://www.acronis.com/enterprise/ | Acronis Corporate Products]]

We do not have a solution at this moment except to turn off the UAC. Could you please create the screen shots of the UAC prompts and add to the created cases? Also please provide us with the sysinfo files. We will forward them to our developers.

If you are not familiar with making screen shots, please read the below step-by-step instructions.

- Get to the window which you want to make a screen shot of;
- Hit the (Alt+)PrintScreen button on your keyboard;
- Run Paint usually available in Start\Programs\Accessories or another graphics application;
- Choose Paste command in Edit menu;
- Save the result picture in JPEG format being preferable.

- Open Start\Programs\Accessories\System Tools\System Information;
- Choose the "Save" option in the "File" menu (or "Action" menu under Windows 2000), enter the "File name" and set the field "Save as type" to "System Information File (*.NFO)";
- Send us the saved file.

Thank you.

Here is some more useful info:

Group Policy Settings Reference Windows Vista
(Allows you to download “VistaGPSettings.xls”, which gives you ALL group policy settings!)

http://www.microsoft.com/downloads/details.aspx?familyid=41DC179B-3328-…

How to use User Account Control (UAC) in Windows Vista
http://support.microsoft.com/kb/922708/

See also: http://technet.microsoft.com/en-us/windows/aa905108.aspx

I found out why Startup Program Unblocker could not unblock “Schedhlp.exe.” See here:
http://www.jimmah.com/vista/applications/startupunblocker_landing.aspx

IF ONLY WE COULD EDIT GROUP POLICY! Boo Hoo:

Disable UAC Using Group Policy (Active Directory GPO or Local Group Policy)

Note: Windows Vista Home Premium and Home Basic editions do not have Local Group Policy Editor.

1. Click Start and then type GPEdit.msc in the Start Search box and hit Enter key to open the Group Policy Editor.
Note: If you’re using Active Directory Domain GPO which controls many computers, open Group Policy Management Console by click on Start, and then type GPMC.msc in the Start Search and hit Enter key from a Windows Vista computer that is a member of the AD domain. In the Group Policy Management Console (GPMC) window, browse to the respective GPO which is linked and enabled to the OU (organization unit) or domain where the Vista computers are located, then edit it.
2. Navigate and browse to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options.
3. In the right details pane, there are a few User Account Control related policies. Right click each of the following policies and configure or change the value to the new value indicated below after the dash (-):
o User Account Control: Behavior of the elevation prompt for administrators – Elevate without prompting
o User Account Control: Detect application installations and prompt for elevation – Disabled
o User Account Control: Run all administrators in Admin Approval Mode – Disabled

4. Restart the computer to make the changes effective.
5. To re-turn on UAC, revert back to original values of the policies, which is Enabled and Prompt for Consent.

So after the hissy fit against Acronis, it turns out to be a Microsoft induced problem?

Hello Oleg,
I have attached the SysInfo file you requested, along with pics of the prompts. (It is not possible to use prntscr during these prompts, so I used a digital camera) I still have not heard back from Acronis about a ticket number for me, for this problem, despite sending it to Anatoly Spesivtsev | Support Professional, to Acronis Customer Central m and CCing it to customerservice@acronis.com, referencing my old ticket number: Case #00253395 (please reply to corparate-support@acronis.com) [ ref:00D3Zcb.50056nC1X:ref ], which was for an installation issue. I also entered the current problem through your ticketing web page, but still have not received a reply. Would you please check on this for me and provide a ticket number? Thank you.

PS--Just before posting this, I got the following message when trying to attach the SysInfo, ".nfo", file:

"The selected file SysInfo_Daniel Miltner_3042_B&R 10 and UAC on Vista x64.nfo could not be uploaded. Only files with the following extensions are allowed: jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp exe js."

This means that I will have to send the pictures UNzipped and try another way to get the .nfo file to you. Without a ticket, that may be a problem. Please advise.

I have changed the file name to: "SysInfo_Daniel Miltner_3042_B&R 10 and UAC on Vista x64.jpg". Try to rename the extension to ".nfo", and see if it reconstitutes properly. The pics were uploaded individually.
Please let me know if you received everything. My email can be found from your records of my profile.
Kind regards,
Dan

Excuse me, "Colin B", but I paid for this software and I expect it to be tested on all platforms that it is supposed to work on and for it to work properly from the get go. A complaint is not a "hissy fit." Second, you have no idea what other problems I have had before this, which took Acronis a looooong time to resolve. (Yes, their installer does not auto create a user and assign the proper privs as it tells you it will) Is it too much to ask Acronis to fire up a virtual machine with Vista Home Premium x64 and actually try installing and running their software on it, before selling it to me and everyone else? I don't think so. Their own people don't seem to even know that Vista Home Premium does not have and can't run polsec.msc, as evidenced by the advice and screenshots from post 2955, depicting a higher version of Vista, with advice to use a group policy editor, despite the fact that the people in that post are also using Home Premium, and therefor aren't able to do that. As for a "Microsoft induced problem,"; how long has Vista and UAC been out? Who created their software to work with Vista (without a proper manifest, I might add), knowing that elevation might be a problem if not properly coded? That's right....Acronis. This is not a Microsoft problem, and I shouldn't be a beta tester. (Don't think I didn't request a refund, which was denied; of course; corp America, what else? "We can create stuff that doesn't work and you just have to wear a smile and eat it.") I have better things to do than to help a multibillion dollar company troubleshoot the software they sold me. And, yes, you are welcome for all the free info I provided; sounds like you could use it. As for me; I'm staying proactive. Nevertheless, peace.

Hello all,

Daniel, we've enabled the possibility to upload .nfo , .zip files and some other types.
Now you can to upload all the information without any issues.

Thanks,

Thank you Michael.
Attached is the .nfo file you requested. Please let me know if you did not receive it. Also, would you please provide me with a case number and keep me informed on the progress of this case?
Thank you,
Dan

Same trouble here. 2 prompts when I start my account.

Martin

Hello all,

Thank you for using [[http://www.acronis.com/enterprise/ | Acronis Corporate Products]]

Daniel,

Here is the case number: 00271901, the appropriate engineer will take care about the request as soon as possible. I attached the files you provided.

Martin,
Please obtain the same files (photos and sysinfo file) and create an e-mail request or contact Live chat service available on [[http://www.acronis.com/support |this page]], under Contact us click on the Start here button and follow the step-by-step guide.

Thank you.

Thank you, Oleg.

One other thing; Even though I click to elevate "elevation_app.exe" at startup/logon, later, when I start Acronis, "elevation_app.exe" requires elevation again, by UAC, just to start running the program. Just thought I would add that. Has your team made any progress on this problem? Any estimate on when this problem might be solved? Without a solution to this problem, any PC with Vista Home Premium that has a scheduled Acronis backup after a reboot without a logon, may not start its backup. I haven't heard anything in days. Please let me know what progress is being made.

Thank you.

Hello all,

Daniel, we are unable to provide you with exact (or at least approximate) time frame for the fix. First thing we have to do is to escalate this case to second level of our support and check the results from them. Please be sure that I will send a notification to our support engineer who is responsible for your case and set the priority to highest.

Thank you very much for your cooperation and understanding!

The autoElevate property.

  It appears Microsoft architected the means to elevate without prompting wihin active UAC. It is the autoElevate property assigned to applications. Various Microsoft applications have this property. Unfortunately there is no means at this time to apply the autoElevate property to third party (i.e., ABR10) applications.

I encountered autoElevate in an article by guru Mark Russinovich, Inside Windows 7 User Account Control wherein he writes,

"Windows executables (as just defined) of the .exe variety auto-elevate if they specify the autoElevate property in their manifest, which is also where applications indicate to UAC that they want administrative rights."

 Unfortunately the autoElevate property cannot be applied outside Microsoft's ivory tower. Russinovich says,

We understand the aggravation, and there might be a legitimate reason that those applications can't run without administrative rights, but the risk is too high that developers will avoid fixing their code to work with standard user rights. Even if the list of what applications get auto-elevated was only accessible by administrators, developers might simply change their application setup program, which requires a one-time elevation, to add their application to the list. We've instead chosen to invest in educating and working closely with application developers to ensure their programs work correctly as a standard user.

So this appears to be a case of Microsoft protecting us all from the un-washed ignorant application developers. There are no exceptions that we know of. Acronis by fiat is lumped in this un-kempt group.

Harry Jacobson

Anti-malware apps elevated?

 It behooves me to wonder how non-Microsoft developers such as McAfee and Symantec get their anti-malware applications to run with elevated privileges...... or do they run without elevated privileges? I don't know.

 Harry Jacobson

It is so aggravating when so-called knowledgeable people say 'just turn UAC off', it's because of that attitude that UAC needs to exist.

The new paradigm, get used to it, is security. If a program needs an elevation in security at boot time or log on, and you wish it run without your input, then you simply have it run as a task in task scheduler. This was true in Vista, and now I'm running Windows 7, same thing.

The program that causes the UAC prompt is not app_enable, or timounter, or schedhlp. It is TrayMonitor.exe.

This will only run when a user is logged on, no other setting works in task scheduler. So because it has to execute after log on - the only trigger that will work is a recurring Daily type, which repeats every 5 minutes (so it will work no matter when I log on).

Yes, this is sloppy, I don't like to see a task constantly running when it only needs to work once, but that is the only way I have been able to have it load.

The ball is now in Acronis' court to clean this kludge up.

I've mostly learned not to post or email when I'm tired and irritated, the previous example is that I sometimes forget.

It is possible to use Task Scheduler (I'm still learning) to bypass that UAC prompt. The 'General' properties tab of the task should specify a user account (there would have to be a separate task for each user in this case), and 'run only when the user is logged on' and 'Run with highest privileges'.

The 'Triggers' tab should specify 'at log on' of that specific user, and under 'Advanced Settings' - Delay task for: 30 seconds.

Under 'Actions' tab - Start a program, Program/Script - "C:\Program Files\Acronis\TrayMonitor\TrayMonitor.exe" (or whatever your path is).

And that works.

And this work around has already been mentioned at least once very early on in the thread. And it isn't just the TrayMonitor. There is another task which causes UAC to kick in and both of these can scheduled as you describe.

Hello,

I have the same problem with Windows 7: I get one UAC request regarding "elevation app" after every login.
@Acronis: You know the problem now for 2 months, do we have a solution now? I expected a Windows 7 compliant product, please provide a fix.

Regards,
Marc

Marc,

Most everything about ABR 10 and UAC is contained in this thread. If you absorbed the content of this thread you would understand why getting ABR 10 to run without UAC prompting may take more than two months. As you joined today (2009-10-21) allow me to review.

1. Acronis Backup and Recovery 10 Standard and Advanced Workstation is Vista and Windows 7 compliant. The UAC elevation prompting is an inconvenience but does not hinder ABR 10 from operating as designed in Windows 7.
2. Per the post above about the autoElevate property Microsoft is pretty cagey about what is permitted to run with administrator privilege without prompting. Their policy is to not enable application developers (e.g., Acronis) to grant their app the autoElevate property.
3. There is a work-around to eliminate UAC prompting when the computer starts. Please read Jason Griffin's post how to do it.

Perhaps if Acronis included in its install creation of the Task Scheduler item ABR 10 would run without the 'problem' of UAC elevation prompt.

Harry

Any status on the UAC elevation_app.exe issue?

While it's a shame that the acronis installer doesn't create the task and instead triggers the UAC prompt, this thread was great. Thanks to Jason and others for coming up with a viable workaround.

I can´t believe Acronis has not figured this out yet, I use Acronis Home 2010 with Windows 7 Professional on 5 computers at home and with Windows 7 enterprise on my work notebook, and have not Had a single UAC prompt issue with it.
On the other half of my life (that been work) I have been appointed the task of reviewing and make a suggestion on a final product for backup solution for all of our 2800 PC users on our corporate network, all of whom have migrated to windows 7 enterprise, to my sadness this UAC on startup is annoying and simply unprofessional, Ive tried Norton Ghost 15 and had no issues with it.
I feel Acronis is by far a greater product on terms of backup management and optional boot recovery options, but Norton behind it´s lack of friendly user interface simply just works on the background with no user interaction or annoying UAC boot prompt.
I feel is a lack of professionalism in part of Acronis to say that users most turn off their UAC, we want security and we expect for a product we pay for to work.
So my question is why does the home version work and the corporate does not.
amaze me with a smart answer please.

I've never used the Home version but presumably it offers the same facilities that B&R10 does i.e. the tray monitor and being able to mount images etc?

Build 11345 seems to have fixed the problem for me. As of this build, TrayMonitor.exe is no longer being run as an elevated process (thus, no UAC prompts on boot). I am running Win 7 64.

Can anyone confirm this? I have not had a scheduled backup trigger yet, so I cannot be absolutely that the tray monitor is actually going to work.

I still get a single UAC prompt on Win 7 Pro x64. I haven't got around to working out which task it is but it hasn't started to get on my nerves enough yet for me to bother doing that! ;-)

Ooops! Double post somehow.

Has this ever been fixed or is there a work around? I can't really use scheduler as I have many sittings on the Acronis task. Well I don't think I can I would need to use MS task scheduler and tell it somehow to execute Acronis and which task within Acronis to run.

Hello Jerrold. I have not revisited the problem for a long time now. No solution was created by Acronis that I am aware of. I finally gave up and turned off UAC. (I know, I know....don't get me started) But, perhaps they have done something about it and I don't know about it since my UAC is off. I'm running build 10.0.12497. I'll try turning on UAC and see what happens at bootup. I can't do it for a day or two, since I am in the middle of something and can't reboot now. I'll post as soon as I have given it a try. By the way, I'll most likely be switching to Macrium's "Reflect," now that they have "restore to disimilar hardware" capability, as soon as my Acronis gets old. I've used Reflect and it works great. Besides, Reflect is cheaper. -TCZ

I was surprised to find when I let the Acronis scheduler run the backup- it ran. So it must not have got the UAC message that required a response.

I checked and still, when I double click on the Acronis icon, I get the UAC message that requires a response.

Guess I don't have a problem.

I have downloaded Reflect and ran the free version and was impressed with speed and ease of use. Had problems with restoring from their rescue disk, wouldn't see my external drive. Was just testing so not a big problem and that was over a year ago.