App start .cmd file, security warning calling regedit.exe only on some machines

[mdlueck]

Greetings,

I rolled my own Access application startup script in Windows NT Command Script (NT Batch .cmd file) language.

On one machine, I see a security warning that the script is going to run Regedit.exe... setting registry settings so that the Access application will work properly and not display security nonsense messages.

I checked with IT about the difference. Their answer is that both machines were imaged the same way... between my test machine and this one which was upgraded today.

So, any suggestions what might the difference be issuing this from a .CMD file?

REM Now merge in the dynamically created registry file
RegEdit.exe /S %XYZRegFile%

Does anyone know something I can set on the workstation during initial application software deployment that would prevent this type of warning from popping each time the application is launched via the desktop shortcut? I apologize for not being able to provide a screen shot of the security warning message, Win7 kindly refused to capture a screen shot to the Windows clipboard... "security risk" no doubt...

 

[DJkarl]

2 machines being imaged the same way does not mean they are still currently the same. It sounds like UAC was turned off on one of the machines.

 

[mdlueck]

2 machines being imaged the same way does not mean they are still currently the same. It sounds like UAC was turned off on one of the machines.

So far I have checked three Win7 machines. Only this one machine is popping the security prompt. Mine and one other do not. So, we are correct, this third/new machine is in error!

What do you specifically mean by the bolded bit? How/what to check?

 

[DJkarl]

UAC - User account control is the nice little feature Microsoft added in Windows Vista, the annoying popups that happen everytime you run a program that can potentially change something on your system.

http://www.howtogeek.com/howto/wind...nt-control-uac-the-easy-way-on-windows-vista/

 

[mdlueck]

On my Win7 test machine, the slider is all the way to the top / default / always notify. Yet I am seeing no warning when RegEdit is about to make changes to the registry. Probably all accounts provisioned by IT have the slider at the top / default / always notify.

What else could be different between these Win7 machines?

 

[DJkarl]

Individual permissions maybe? Are you part of a power user or admin group, or are they part of a different user group?

 

[mdlueck]

I have my test account locked down as best I can... I have made it a member of the local Guest group. I want to be sure my application will deploy / run without error no matter what.

Initially my account (domain account, workstation permissions of) had Admin permissions. I issued these commands to create a workstation admin account:

  C:\> NET USER Fandango password /ADD /EXPIRES:NEVER
  C:\> NET LOCALGROUP Administrators Fandango /ADD

Then I logged into that local admin account and adjusted the workstation permissions of my domain account down to Guest, then started application testing... deploying the software, etc... and no security messages appeared for me.

I understand IT is rolling out new machines with local Administrator permissions, so they probably have local admin.

 

[mdlueck]

Bump... any ideas?

Logged in with my domain account, local group permissions is User group, and the notify slider is all the way to the top indicating "always notify", I get no notification when RegEdit executes in the NT batch file. (No prompt is what I want to achieve.)