Unable to interact with Notifier prompt during remote sessions with Windows UAC enabled

Products

• Carbon Black App Control

Issue/Introduction

• Users cannot interact with the Carbon Black App Control Agent Notifier prompt window when working over remote sessions using Parse or Windows RDP after enabling Windows OS UAC (User Account Control).
• By using Tab to toggle to the justification box the users are able to input a reason, but the Submit button remains greyed out.

Environment

• Carbon Black App Control Agent: 8.10.x and higher
• Microsoft Windows OS: Windows 11 and higher
• Microsoft Windows UAC: Enabled
• Parsec RDP Client: https://parsec.app/ 

Cause

There is a security conflict between Windows 11's User Interface Privilege Isolation (UIPI), App Control's Protected Process Light (PPL) status, and the input injection mechanisms used by remote access software like RDP and Parsec.

Resolution

1. Ensure Remote Software Services are running as SYSTEM. Change the remote software so that it is not running purely in "User mode."

   1. For Parsec: Verify that the Parsec Service (pservice.exe) is installed, configured for "Automatic" startup, and actively running as SYSTEM. If users are running the portable version of Parsec, they will never be able to click on the notifier.

   2. For RDP: If using third-party RDP wrappers or thin clients, ensure they hook into the OS using standard input-driver models rather than user-space software simulators.

2. Enable UIAccess Bypass in Group Policy for the UAC and configure Windows to allow applications with UIAccess privileges to bypass the secure desktop restrictions:

   1. Open the Local Group Policy Editor (gpedit.msc).

   2. Navigate to: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.

   3. Locate the policy: "User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop".

   4. Set it to Enabled.

Additional Information

• Disabling the "Switch to the secure desktop" policy for UAC only controls where the UAC credential screen appears; it does not disable the underlying integrity boundaries that Windows enforces on the standard desktop. In Windows, third-party applications can only bypass UIPI restrictions to interact with elevated windows if they run with UIAccess privileges. To utilize UIAccess, a remote access application must:
  • Have uiAccess="true" defined in its application manifest.
  • Be digitally signed by a trusted certificate authority.
  • Be installed and run from a secure system directory (like C:\Program Files\).