Kelly_Y
Hi Kelly,
Thanks for the quick response and suggestion. I'm glad that parameter exists, but unfortunately I don't think it will help for our particular use case (an application opens the machine's default browser to a web page, not from a shortcut). Is there an equivalent registry value for this?
After digging into this issue a little more, I think perhaps that it's not the de-elevation itself that is causing problems, but that it does not always de-elevate as the same user that started the process.
Here's an example they should be able to duplicate:
- Log into a machine as a standard user (User 1)
- Run PowerShell as administrator (User 2)
- Enter credentials for User 2
- Run Start-Process msedge.exe
The Edge process initially opens as User 2, then de-elevation kicks in and re-launches the process as User 1.
A use case where this would become important is where IWA is used, and User 1 and User 2 have different access. If you launch a browser targeting a particular page as User 2, it de-elevates and re-launches as User 1, and SSO signs User 1 in.
This obviously isn't a problem if you 'Run as other user' rather than 'Run as administrator', so this is an OK workaround, but there are two problems I found with this:
- If you have the policy BrowserSignin set to 2, and you launch Edge as another user that does not yet have an Edge profile, the login prompt appears, but does not allow you to interact with it. This might be a bug.
- There doesn't appear to be a way to launch Windows Terminal as another user without launching it as administrator.
We are in the process of hybrid joining our machines, so I'll be able to do away with BrowserSignin soon. We can also just steer people toward other terminal apps and have them run without elevation.
We noticed this behavior using the Okta ASA product, but I'd imagine there are other use cases as well.
Hope this helps!
Andrew
