Autopilot Windows 11 (Host Process for Windows Services) constantly notification

[JimmyWork]

Started having this issue on newly enrolled Windows 11 devices in Autopilot.

No changes have been made and never had this issue before.

Devices enrolled before does not have this issue, wiping a device or running fresh start same issue

UAC shows up constantly.

[#2]

No one?

I seem to get this issue when I run a Autopilot Reset

[#3]

Seems that the Security Baseline setting Local Policies Security Options > Administrator elevation prompt behavior might have been the issue, my last setting was "Prompt for credentials on secure desktop"

Setting it to Prompt for consent on non-Windows binaries seems to have solve it, at least on my current tests

[#4]

I assume you are deploying some drivers to the device when its enrolled into Autopilot? care to show us how you are doing this? as normally that uac prompt shouldn't be shown (depends of course on the config... but... )

[#5]

Thank you for answering but I'm not deploying any drivers.
I never had this issue before, just started showing on my test device, did no changes to my configs. Windows 11.

But never had the issue before did multiple re-deploys of test machine no issues then it just started to happen, not sure if it's an update in Windows 11 that is causing it or why really. Still testing now multiple scenarios after I changed my security baseline to see if I can replicate it, currently it seems to have gone away.

[#6]

Was deviceguard enabled in the baseline? As the screenshot mentions the driver purpose…. Also no wufb with drivers enabled? (Just checking)

[#7]

@Rudy_Ooms_MVP 

The issue just showed up again.

I have had over 25 devices no issues, now it just started happening on new devices, no changes have been done.

On my test device I did run a Wipe. Everything went fine no prompt during OOBE.

Then when I tested to make the logged in user an admin using PIM the issue showed up twice again.

Is there any logs I can check why its prompting me, like event viewer or something?

[#8]

New information.
Most likely some kind of police that creates this issue.

New test device, user is Admin.
Co-Managed, when move into Intune and applied the Intune policies the user got.

UAC prompt: Host Process for Windows Services.
Any input on how I can track down whats triggering the UAC, what logs to check etc?

[#9]

We are installing the Quick Assist tool, but I need to confirm that this is the reason why they are getting the prompt. So any details on how I can check the logs, locally or using Advanced Hunting would be much appreciated.

https://call4cloud.nl/2022/05/the-100-year-old-quick-assist-tool-who-climbed-out-the-window-and-disa...

[#10]

Maybe you can use "ProcessTokenElevation" in the "DeviceProcessEvents" table to find processes with elevation, but I doubt that'll give you an answer. Isn't it easier to just exclude the device/user from the app and test if the UAC-prompt disappears?

[#11]

That would indeed be an easy test :).. just exclude the app from 1 test user and enroll a device :)

[#12]

Will try this on next batch of users and report it back. Right now they only need to click it once so I mean it is OK but not good.

[#13]

@JimmyWork 

I seem to have the same issue. I now removed Quick Assist (Online) from 'required' applications and it does not prompt for admin rights. Seems that Microsoft make it as hard as possible to install Quick Assist. 

[#14]

Any updates on this? I'm having this same issue and it's a total nusiance. It looks like it pops up for any Microsoft product that is installed once the laptop boots into the Autopilot settings.  @JimmyWork 

[#15]

I actually excluded it from installation due to a recent license changed where Remote Help was included in our licensing, and that can be installed without an issue. So I did not look more into the issuse, but Quick Assistent is the issue, should be a MS ticket maybe.

[#16]

https://call4cloud.nl/2022/05/the-100-year-old-quick-assist-tool-who-climbed-out-the-window-and-disa...

[#17]

Yes. It's Quick Assist. I went through all apps and removed every app, after app one by one from require and it only prompts on Quick Asist at the end. I had some apps that had to install using computer account rather than user but at the end the only one that left not installing without prompt was Quick Assist.