Requesting Administrator Permissions in Remote Support Sessions
Overview
This article explains how User Account Control (UAC) screen visibility and administrator escalation work during ScreenMeet Remote Support sessions, and how this behavior differs across EXE, MSI, and Tanium-based client deployments.
EXE Client (Ad-Hoc)
The EXE client is used for one-time, ad-hoc support sessions and does not install persistently on the end-user's device.
- Until admin permissions are requested, the agent cannot see or interact with any UAC prompts that appear on the user's machine during the session.
- If a Windows UAC window appears at any time prior to escalation, the agent will see the following message.
- To gain access, the agent must go to Windows Tools > Request Admin Permissions.
- The end user will see the following prompts on their screen.
- Once the request is approved by the end user and the agent enters valid credentials, the agent can view and interact with UAC screens for the remainder of the session.
MSI Client (Persistent Installation)
The MSI client installs persistently and is intended for enterprise environments with recurring support needs.
- Unlike the EXE client, the MSI client gives the agent visibility into UAC screens from the start of the session, without requiring a separate request.
- Admin escalation is not automatic. For security reasons, the agent must still escalate to gain full administrator rights even though UAC screens are already visible.
- Escalation can be done either through Windows Tools > Request Admin Permissions or in session by entering admin credentials directly into a UAC prompt as it appears on the user's machine.
Tanium-Based Client
Clients deployed via and started from Tanium behave similarly to MSI clients.
- Agents can see and interact with UAC screens from the start of the session.
- Full administrator escalation still requires agent action, either via the Windows Tools > Request Admin Permissions flow or by entering credentials directly into the UAC prompt.
Visual Diagram
Key Differences
| Client Type | UAC Screen Visibility (Before Escalation) | Escalation Required | Escalation Methods |
|---|---|---|---|
| EXE (Ad-Hoc) | Not visible until escalated | Yes | Windows Tools > Request Admin Permissions |
| MSI (Persistent) | Visible from session start | Yes | Windows Tools flow or in-session credential entry |
| Tanium-Based | Visible from session start | Yes | Windows Tools flow or in-session credential entry |