Tuesday, March 10, 2015

Uninstall program from the command line, fails as non-admin, fails as admin with RUNAS

Uninstall program using "Run As" as admin fails when a non-admin is currently logged in and UAC is disabled.

The problem is as follows:
Generally helpdesk has a need to uninstall/reinstall a program on an end-user's PC whilst the end-user is logged in. Another case is admin simply needs to uninstall a program\app\driver from a non-admin end user's computer.

The problem is that if UAC is turned OFF (never notify), you cannot remove(uninstall) a program, even though you are logged in as an ADMIN, via the runas command. The process fails.
When I say UAC is disabled, I mean User Account Control is set to "never notify"



For Example:
Joe User (non admin) is currently logged in.
UAC is disabled on the user's PC (see image above).
You, a domain admin, are at the user's PC - either in person or via a screen sharing technology.
You run (from command line) "runas /user:BillyTheAdmin@domain.local cmd"
You are prompted for your password - you enter your password
A new command line opens with your credentials, you type "appwiz.cpl"
   (Alternatively you could have run "runas /user:BillyTheAdmin@domain.local appwiz.cpl")
add\remove programs opens, you select the program you wish to remove, click Uninstall.
You are prompted with "You must be an administrator.... The process fails, the app is not uninstalled/removed.



In the above scenario, IF UAC was ENABLED you would be prompted again for your username/password and the process would succeed.

*Note: To access the user account control settings as an admin by running the following:
C:\Windows\System32\UserAccountControlSettings.exe

To work around the issue and AVOID logging out the user you can uninstall\remove apps from the command line. In this example, I want to remove the Live Meeting 2007 client.

1. Open a command prompt as an administrator
    In my example, run "runas /user:BillyTheAdmin@domain.local cmd"

2. Input WMIC and press Return. You will see a prompt that looks like this:
wmic:root\cli>

3. At the new prompt, execute the following command:
product get name

This will generate a list of installed applications. On my computer (very fast PC) this took 30 seconds to return results, be patient.

4. At the prompt, execute the following command:
product where name="exact product name" call uninstall
where application name is the name of the program you wish to uninstall (use the exact name provided by the previously generated list).

In the image below, the output is from "product get name". I want to uninstall the live meeting client.



5. When prompted, input "y" to confirm that you wish to uninstall the application and press Return. In the image below the line is very long (I tried to capture it, sorry if the image appears small).



The application will be uninstalled. You will get a quasi-useless return code.


Type "Exit" to leave WMIC
Type "Exit" to close the cmmand line

1 comment: