CMAK elevated privs for Vista

I am trying to use a CMAK package that was built on Server 2003 with Windows
Vista. The client works perfectly on 2000 and XP. It adds a route and removes
the default gateway. When run on Vista an error complains that CMROUTE.DLL
needs to be run with elevated privileges. Is there a way around this? Would
CMAK on Server 2008 work? I have not tried that yet as I have no instances
running. I saw a reference to using a DHCP scope option, but could not find
the proper details.

Your help is greatly appreciated!

-----------
Anyone who knows everything, leads a pretty boring life

Hello,

Thanks for your post.

The cmroute.dll is used to update the client routing table on the client
computer according to the CMAK package. However, there is a compatibility
issue for implementing CMAK created in previous operation system in the
Windows Vista. From my research, you can modify the routing configuration
files as follows:

Original routing configuration file like:

ADD 192.168.2.0 MASK 255.255.255.0 default METRIC 1 IF default
ADD 192.168.3.0 MASK 255.255.255.0 default METRIC 1 IF default
ADD 192.168.4.0 MASK 255.255.255.0 default METRIC 1 IF default
ADD 10.3.0.0 MASK 255.255.0.0 default METRIC 1 IF default
ADD 10.5.0.0 MASK 255.255.0.0 default METRIC 1 IF default
REMOVE_GATEWAY

Modify the default METRIC from 1 to "default"

ADD 192.168.2.0 MASK 255.255.255.0 default METRIC default IF default
ADD 192.168.3.0 MASK 255.255.255.0 default METRIC default IF default
ADD 192.168.4.0 MASK 255.255.255.0 default METRIC default IF default
ADD 10.3.0.0 MASK 255.255.0.0 default METRIC default IF default
ADD 10.5.0.0 MASK 255.255.0.0 default METRIC default IF default
REMOVE_GATEWAY

Then save and check how it works.

More information about routing table updates you may refer to:

Including routing table updates
http://technet2.microsoft.com/window...8-1138-4186-9a
bb-32b31ca8eac41033.mspx

Hope it helps.



Sincerely,
Miles Li

Microsoft Online Partner Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
================================================== ===
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

Thank you for the response. However, the issue I am having is not updating
the routing table, that works fine and the file I added to CMAK was
configured as you suggested. The issue is on Vista when running the client,
there is an error that pops up telling me that the CMROUTE.DLL needs to be
run with elevated privileges. I donot want endusers having to deal with that
and this was not the case on XP. Is there a way to create a package with CMAK
that does not invoke this message? In other words, is it possible to somehow
address this programmatically?

-----------
Anyone who knows everything, leads a pretty boring life


"Miles Li [MSFT]" wrote:

> Hello,
>
> Thanks for your post.
>
> The cmroute.dll is used to update the client routing table on the client
> computer according to the CMAK package. However, there is a compatibility
> issue for implementing CMAK created in previous operation system in the
> Windows Vista. From my research, you can modify the routing configuration
> files as follows:
>
> Original routing configuration file like:
>
> ADD 192.168.2.0 MASK 255.255.255.0 default METRIC 1 IF default
> ADD 192.168.3.0 MASK 255.255.255.0 default METRIC 1 IF default
> ADD 192.168.4.0 MASK 255.255.255.0 default METRIC 1 IF default
> ADD 10.3.0.0 MASK 255.255.0.0 default METRIC 1 IF default
> ADD 10.5.0.0 MASK 255.255.0.0 default METRIC 1 IF default
> REMOVE_GATEWAY
>
> Modify the default METRIC from 1 to "default"
>
> ADD 192.168.2.0 MASK 255.255.255.0 default METRIC default IF default
> ADD 192.168.3.0 MASK 255.255.255.0 default METRIC default IF default
> ADD 192.168.4.0 MASK 255.255.255.0 default METRIC default IF default
> ADD 10.3.0.0 MASK 255.255.0.0 default METRIC default IF default
> ADD 10.5.0.0 MASK 255.255.0.0 default METRIC default IF default
> REMOVE_GATEWAY
>
> Then save and check how it works.
>
> More information about routing table updates you may refer to:
>
> Including routing table updates
> http://technet2.microsoft.com/window...8-1138-4186-9a
> bb-32b31ca8eac41033.mspx
>
> Hope it helps.
>
>
>
> Sincerely,
> Miles Li
>
> Microsoft Online Partner Support
> Microsoft Global Technical Support Center
>
> Get Secure! - www.microsoft.com/security
> ================================================== ===
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ================================================== ===
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>

Ok I have installed a Server 2008 system and used the updated CMAK tool,
however, I am still required to use elevated privileges when launching the
VPN client package. Simply put, is there a way create this package without
receiving this prompt? Is there another alternative?

Thank you for your help!

-----------
Anyone who knows everything, leads a pretty boring life


"UWide User" wrote:

> Thank you for the response. However, the issue I am having is not updating
> the routing table, that works fine and the file I added to CMAK was
> configured as you suggested. The issue is on Vista when running the client,
> there is an error that pops up telling me that the CMROUTE.DLL needs to be
> run with elevated privileges. I donot want endusers having to deal with that
> and this was not the case on XP. Is there a way to create a package with CMAK
> that does not invoke this message? In other words, is it possible to somehow
> address this programmatically?
>
> -----------
> Anyone who knows everything, leads a pretty boring life
>
>
> "Miles Li [MSFT]" wrote:
>
> > Hello,
> >
> > Thanks for your post.
> >
> > The cmroute.dll is used to update the client routing table on the client
> > computer according to the CMAK package. However, there is a compatibility
> > issue for implementing CMAK created in previous operation system in the
> > Windows Vista. From my research, you can modify the routing configuration
> > files as follows:
> >
> > Original routing configuration file like:
> >
> > ADD 192.168.2.0 MASK 255.255.255.0 default METRIC 1 IF default
> > ADD 192.168.3.0 MASK 255.255.255.0 default METRIC 1 IF default
> > ADD 192.168.4.0 MASK 255.255.255.0 default METRIC 1 IF default
> > ADD 10.3.0.0 MASK 255.255.0.0 default METRIC 1 IF default
> > ADD 10.5.0.0 MASK 255.255.0.0 default METRIC 1 IF default
> > REMOVE_GATEWAY
> >
> > Modify the default METRIC from 1 to "default"
> >
> > ADD 192.168.2.0 MASK 255.255.255.0 default METRIC default IF default
> > ADD 192.168.3.0 MASK 255.255.255.0 default METRIC default IF default
> > ADD 192.168.4.0 MASK 255.255.255.0 default METRIC default IF default
> > ADD 10.3.0.0 MASK 255.255.0.0 default METRIC default IF default
> > ADD 10.5.0.0 MASK 255.255.0.0 default METRIC default IF default
> > REMOVE_GATEWAY
> >
> > Then save and check how it works.
> >
> > More information about routing table updates you may refer to:
> >
> > Including routing table updates
> > http://technet2.microsoft.com/window...8-1138-4186-9a
> > bb-32b31ca8eac41033.mspx
> >
> > Hope it helps.
> >
> >
> >
> > Sincerely,
> > Miles Li
> >
> > Microsoft Online Partner Support
> > Microsoft Global Technical Support Center
> >
> > Get Secure! - www.microsoft.com/security
> > ================================================== ===
> > When responding to posts, please "Reply to Group" via your newsreader so
> > that others may learn and benefit from your issue.
> > ================================================== ===
> > This posting is provided "AS IS" with no warranties, and confers no rights.
> >
> >

Hello.

The route table updating via Cmroute in the CMAK package requires admin
privileges. Because of the introduction of UCA (user account control) in
Windows Vista, you need to running CM profile with cmroute custom action
from admin user (user in administrative group and with UAC disabled) or
from elevated cmd. If UAC is enabled then cmroute will ask for elevation.

If you do not want to receive the prompt, you may consider the following
options:

1. Refer to the following KB to disable UAC for the generated CMAK package.
2. Disable UAC on all Vista clients. (not the preferred practice)

How to disable the User Account Control Prompt for certain application
http://msmvps.com/blogs/xperts64/arc...c-prompt-for-a
-single-application.aspx


The steps to disable the User Account Control Prompt for certain
application:

1) Download and install the Application Compatibility Toolkit (link below).
2) Open the Compatibility Administrator application with elevated
credentials.
3) In the left hand pane, right-click on the database under Custom
Databases and
select Create New Application Fix
4) Enter the name and other details of the application you want to alter
behavior
on and then browse to it to select it.
5) Click Next until you are in the Compatibility Fixes screen.
6) To prevent being prompted to elevate an application (which means that it
will
always use the less privileged credential to run) place a checkmark next to
RunAsInvoker.
7) Click Next and then Finish.
8) Select File and Save As. Save the file as a filename.SDB type file in a
directory you will easily find it.
9) Copy the <filename>.sdb file to the Vista computer you want to alter the
elevation prompt behavior on.
10) Open an elevated command prompt.
11) Run the command (without the quotes, assuming you copied the file to
the
Windows directory on C: "sdbinst c:\windows\<filename>.sdb" and then
press
enter.

Microsoft Application Compatibility Toolkit 5.0
http://www.microsoft.com/downloads/d...9E9-B581-47B0-
B45E-49
2DD6DA2971&displaylang=en

More info on the other options you have in altering application launch
behavior are
available at the URL below:

Application Compatibility Feature Guide
http://www.microsoft.com/technet/des...d/AppCompact_6
.mspx


Sincerely,
Miles Li

Microsoft Online Partner Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
================================================== ===
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi, I downloaded and installed the Application Compatibility Toolkit on my
Vista computer and opened the Administator app as explained. To disable the
elevation prompt for cmroute.dll what executable do I point the progam at?

Thanks

Hi,

You may point the program to the executable files that CMAK generated.

Sincerely,
Miles Li

Microsoft Online Partner Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
================================================== ===
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi,
Did you fix the problem ? Which executable did you use for patching ?

Thanks in advance,

Bart

"Miles Li [MSFT]" wrote:

> Hi,
>
> You may point the program to the executable files that CMAK generated.
>
> Sincerely,
> Miles Li
>
> Microsoft Online Partner Support
> Microsoft Global Technical Support Center
>
> Get Secure! - www.microsoft.com/security
> ================================================== ===
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ================================================== ===
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>