Elevation and Run-As Considerations in Microsoft App-V Environments

Applications whose manifests specify automatic elevation (for example mmc.exe) may require additional steps to work correctly using run-as in App-V environments.

his is a common scenario for environments that require using separate credentials from the account used to log on to the desktop. For instance, a normal user account may be used to log on to a Windows 7 Professional desktop, and then a second account with administrative rights may be used to launch the System Center Configuration Manager (ConfigMgr) Administration Console by shift-right-clicking on the shortcut and choosing Run as different user.

Errors will vary depending on the application. For the Configuration Manager console, the MMC may fail to load with the error: Error initializing console.

Cause

This behavior is by design. When an shortcut to a an App-V virtualized application is launched that invokes sftlp.exe (for example, MMCs and other non-executable images), ShellExecute() does not request elevation. If you log on to the desktop using the same administrative account that is used to launch the shortcut, the process will elevate successfully.

Resolution

Workaround #1 - use the Elevation PowerToy

1. Download and install the Vista Elevation PowerToy
2. Modify the shortcut to use elevate.cmd. For example, this command line:

"C:\Program Files (x86)\Microsoft Application Virtualization Client\sfttray.exe" /launch "ConfigMgr 1.0"

becomes

C:\Elevation\elevate.cmd "C:\Program Files (x86)\Microsoft Application Virtualization Client\sfttray.exe" /launch "ConfigMgr 1.0"

Workaround #2 - configure sfttray to always launch with elevation

Right-click on C:\Program Files (x86)\Microsoft Application Virtualization Client\sfttray.exe and choose properties. Click on the Compatibility tab. Click Run this program as an administrator and then click Apply and OK to exit. This will cause all App-V packages to run with administrative privileges, and should only be used for testing.

Source: http://blogs.technet.com/b/appv/archive/2011/06/27/new-kb-elevation-and-run-as-considerations-in-microsoft-app-v-environments.aspx

Similar Posts:

• How to recover from accidently enabling System Center Configuration Manager App-V integration
• Adding Shell Extensions to App-V Packages
• ScriptLogic Privilege Authority Review
• How to configure App-V with Microsoft Network Load Balancing (NLB)
• Everything you ever wanted to know about the Read-only App-V cache