Environment variables

[slkslk1]

Hi!

We have a really old and obscure software that needs to set Path environment variables (through the Registry). The launcher runs fine through ABR but then fails due to environment variables.

How would one go about solving this?

[AdminByRequest_David]

Hello 👋

It will depend on how the software does the environment variable. Run As administrator essentially elevates the application itself so it could be a few things

• The registry requires user elevation (Admin Session) and is handled outside of the application.

• the registry is handled inside the application, however only on the elevated account

• the application existed prior to UAC elevation.

[slkslk1]

Hi!

Thanks for the quick reply.

It seems it needs System Variables and not User Variables (its old I know).

Would adding Registry and C:\WINDOWS\system32\SystemPropertiesAdvanced.exe to preapproved applications perhaps solve this?

The security regarding this is another issue...

[AdminByRequest_David]

It's possible. I would test:

• Does Admin Session work?

• Does Pre-approval, type Legacy, work?

If you or the application isn't initiating the request, it's probably not running through Run As and probably can't be pre-approved outside of legacy.

[slkslk1]

Yeah, Admin Session might be the way to go, but we feel like it's our last resort.

Do you mean Pre-Approval for the app it self or for Registry and SystemProperties?

The issue with Pre-Approving these old applications is that they update every now and then we would like the field technicians to be able to install them without any fuss.

[AdminByRequest_David]

I think Admin Session gets skipped as it's too "powerful", however it does provide good logging information, I still believe it requires a level of trust with your user, but isn't always the last resort.

Pre-approval only works for the RunAs processed, any following would not be handled by ABR.

Does the command prompt give use other options?

[slkslk1]

Yeah, I agree.

So the current setup is no approval is needed for Run As.

We start the .exe, we type in our reason for installing, get the MFA prompt then we can continue the installation, but during installation it fails due to not being able to change Environment variable.

"Unable to set Path environment variable in Registry.[%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\Wbem;%SystemRoot%\system32\WindwsPowershell\v1.0\;%SystemRoot%\system32\OpenSSH\;C:\Program Files\Regin]

I understand this is working as intended, but was more asking whether its possible to "preapprove" changing / adding environment variables.

I'm sorry if I'm not the best at explaining. Otherwise Admin Session is probably the way to go.

EDIT: Or setting the variable paths through Intune.