Sandboxie & UAC

[kawaiiwolf]

For reference, I'm running sandboxie under windows 10.

Whenever a sandboxed application requests UAC, unfortunately the UAC box reports that Sandboxie is askign for the permission. I'm able to catch snippets of a new box that pops up shortly before the screen goes blank for UAC to do it's thing. I suspect more detailed information about the request can be found therein but I never get a chance to see it.

Is there a fix/solution for this ? I'd generally like to know what in a sandbox is requesting administrative privileges, but I have the assurance that the effects are at least sandboxed.

[Craig@Invincea]

It just states that SBIE has triggered the UAC requesting Admin privileges to allow an installation of the program you've selected. (Screenshot example)

There is a good thread here about that
http://forums.sandboxie.com/phpBB3/view ... hp?t=13609

[henryg]

I always wondered about this! It flashes past on my system so quickly I never get to see it properly; but I recognise the format. Will sleep much better tonight

[Craig@Invincea]

LOL. Ya, it's gotten faster under 10. It's a warning notice for the warning... I actually had to do a screen recording to capture it, then pause. I'm not sure about a fix, but it's more of a user beware notice...

[kawaiiwolf]

Yes, that's exactly what I want to see and suspected it was, but couldn't confirm.

The fix I'm looking for: Give this screen MORE visibility ! It tells me not only what's asking for permission but in what sandbox which is perfect. So the question then becomes, how do we give this more screen time ?

I see two options:
1) Disable the modal screen clearing of UAC so you can still see background windows. Likely tricky and possibly not desirable.
2) Have this Sandboxie popup act as an additional step. Click YES to open UAC as normal, click NO to assume UAC failure, no access for you. This is one more step but it prevents useful information without having to tinker with window's security model. I can see it get annoying for some users but a setting in sandboxie global config could disable this extra delay.

[Craig@Invincea]

1) Disable the modal screen clearing of UAC so you can still see background windows. Likely tricky and possibly not desirable.
2) Have this Sandboxie popup act as an additional step. Click YES to open UAC as normal, click NO to assume UAC failure, no access for you. This is one more step but it prevents useful information without having to tinker with window's security model. I can see it get annoying for some users but a setting in sandboxie global config could disable this extra delay

1. It's not possible that I know of.
2. In your feature idea, Clicking for example "no" in SBIE popup would still, most likely have the requirement to have you click yes/no in Windows authorizing/granting access. Unless you specifically turn of UAC for Windows Security. That's probably something we shall leave alone.

You have the Drop Rights option in SBIE. http://www.sandboxie.com/index.php?Rest ... tings#drop

It's better off to let the user "tinker with UAC" and the notifications/warnings it presents, than have SBIE override a Windows Security setting for which a user may not fully understand.

[kawaiiwolf]

1. It's not possible that I know of.
2. In your feature idea, Clicking for example "no" in SBIE popup would still, most likely have the requirement to have you click yes/no in Windows authorizing/granting access. Unless you specifically turn of UAC for Windows Security. That's probably something we shall leave alone.

You have the Drop Rights option in SBIE. http://www.sandboxie.com/index.php?Rest ... tings#drop

1. After a little searching it is possible via a policy/registry tweak, but not recommended.
2. Maybe instead of "yes/no" just an "OK". But this still might be tough. At this point I'd even be happy with having the screen linger around or log the attempt somewhere, so I can Deny the attempt, look to see what it was then let it try again.

As far as the Drop Rights, not needed =) I don't log in as an administrative user to prevent code running with superuser privileges, UAC or no. I've got an odd setup, I like to install applications directly into sandboxes to prevent them from tangling up the hard disk/registry and prevent them from communicating with eachother. UAC prompts are expected, especially if software needs to update.