{"id":325,"date":"2019-04-03T16:34:34","date_gmt":"2019-04-03T16:34:34","guid":{"rendered":"http:\/\/172.23.1.43\/?p=325"},"modified":"2022-06-07T22:26:13","modified_gmt":"2022-06-07T22:26:13","slug":"application-installation-in-workspace-one-uem-do-you-need-admin-rights","status":"publish","type":"post","link":"https:\/\/blog.n-dol.org\/2019\/04\/03\/application-installation-in-workspace-one-uem-do-you-need-admin-rights\/","title":{"rendered":"Application installation in Workspace ONE UEM, do you need admin rights ?"},"content":{"rendered":"\n<p>One of the thing that come back often is: do I need admin rights or not ?!. While most of the people will think that this question can only be asked for a user context, it is not true and this apply to device context too.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" width=\"694\" height=\"229\" src=\"http:\/\/172.23.1.43\/wp-content\/uploads\/2019\/03\/admin-rights1.jpg\" alt=\"admin-rights1\" class=\"wp-image-329\" srcset=\"https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/03\/admin-rights1.jpg 694w, https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/03\/admin-rights1-300x99.jpg 300w\" sizes=\"(max-width: 694px) 100vw, 694px\" \/><\/figure>\n\n\n\n<!--more-->\n\n\n\n<p>People think that device context means admin rights or super user everywhere.<\/p>\n\n\n\n<p>This belief come from the XP and before era where, indeed, executing something in SYSTEM context meant to have full right on everything.<\/p>\n\n\n\n<p>However, since the infamous Windows Vista, Microsoft have introduced the User Account Control (UAC) (infamous too&#8230;) which don&#8217;t give full right by default. Which lead to this \ud83d\ude42<\/p>\n\n\n\n<div class=\"wp-block-image size-full wp-image-333\"><figure class=\"aligncenter\"><img decoding=\"async\" width=\"360\" height=\"273\" src=\"http:\/\/172.23.1.43\/wp-content\/uploads\/2019\/04\/meme-iownyou.gif\" alt=\"meme-Iownyou\" class=\"wp-image-333\"\/><figcaption>Copyright Disney<\/figcaption><\/figure><\/div>\n\n\n\n<h1 class=\"wp-block-heading\">What is UAC ?<\/h1>\n\n\n\n<p>UAC is a system based on a theory that a user or a device should be able to do some configuration or file change across the operating system, without further right unless it might impact the stability or the security of the OS itself, in this case it will have to ask for admin rights also called super token.<\/p>\n\n\n\n<p>The super token is the key to modify secure folders, drivers, system settings, etc. For example, modifying the time is an admin action requiring the super token because it can affect security systems.<\/p>\n\n\n\n<p>The secure locations are the following :<\/p>\n\n\n\n<ul><li class=\"\">\\Program Files\\ including subdirectories<\/li><li>\\Windows\\system32\\<\/li><li class=\"\">\\Program Files (x86)\\ including subdirectories for 64-bit versions of Windows<\/li><\/ul>\n\n\n\n<p>UAC is doing more than asking for credentials and you can check it in the source links at the bottom of the article. You can also change the behaviour of UAC but this not part of this article and we assume that Windows is in the default configuration.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Admin right or not ?<\/h1>\n\n\n\n<p>Now that we have in mind how Windows will react in terms of access. We just need to analyze the application to see whether the admin right will be required or not.<\/p>\n\n\n\n<p>Most of the time the application install in &#8220;Program Files&#8221; because it&#8217;s the default folder. However most of the applications can be installed elsewhere. It is true for user context application which might need to be installed only in the user area, i.e: User folder.<\/p>\n\n\n\n<p>For installation modifying system settings or installing drivers, admin right are required to be able to modify the necessary folders and settings.<\/p>\n\n\n\n<p>Bottom line, know exactly what the installer is doing and where, then you will know if admin rights are required or not.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" width=\"845\" height=\"682\" src=\"http:\/\/172.23.1.43\/wp-content\/uploads\/2019\/04\/flowchart.jpg\" alt=\"Flowchart\" class=\"wp-image-332\" srcset=\"https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/04\/flowchart.jpg 845w, https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/04\/flowchart-300x242.jpg 300w, https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/04\/flowchart-768x620.jpg 768w\" sizes=\"(max-width: 845px) 100vw, 845px\" \/><\/figure>\n\n\n\n<p>I&#8217;ve designed a simple flowchart to help with the decision-making.<\/p>\n\n\n\n<p>Sources :<\/p>\n\n\n\n<ul><li>Secure locations : <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/security-policy-settings\/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/security-policy-settings\/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations (opens in a new tab)\">https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/security-policy-settings\/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations<\/a><\/li><li>UAC Architecture : <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/identity-protection\/user-account-control\/how-user-account-control-works#uac-architecture\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/identity-protection\/user-account-control\/how-user-account-control-works#uac-architecture (opens in a new tab)\">https:\/\/docs.microsoft.com\/en-us\/windows\/security\/identity-protection\/user-account-control\/how-user-account-control-works#uac-architecture<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>One of the thing that come back often is: do I need admin rights or not ?!. While most of&hellip;<\/p>\n","protected":false},"author":5614970,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[2157457,38600,1986749,672890795],"tags":[22299055,722452,672890813,651069476],"_links":{"self":[{"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/posts\/325"}],"collection":[{"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/users\/5614970"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/comments?post=325"}],"version-history":[{"count":4,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/posts\/325\/revisions"}],"predecessor-version":[{"id":834,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/posts\/325\/revisions\/834"}],"wp:attachment":[{"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/media?parent=325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/categories?post=325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/tags?post=325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}