Windows app deployments show random UAC prompts and native enrollment asks for Microsoft accountSolved

Hello @im_dany ,

The difference in behavior usually comes down to how Windows handles installer privileges, the type of installer being deployed, and the installation scope configured in Hexnode.

For app deployments that install silently without prompting for admin rights, one of the following is usually true:

• The app is being installed in system context. If the package is configured for All User Accounts, the Hexnode agent runs the installer using the local system account, which has the required privileges.
• The application is a per-user installer. Some apps install only inside the logged-in user’s profile, such as under AppData, and do not need admin rights.

UAC prompts are commonly seen when:

• The EXE is configured to run in the current user context, and the logged-in user is a standard user.
• The installer tries to write to protected locations such as Program Files or HKLM registry keys.
• The EXE package does not include the correct silent installation arguments, causing Windows to launch an interactive setup wizard.

For EXE deployments, make sure the package is configured with the correct installation scope and the vendor-supported silent switches, such as /S, /silent, /VERYSILENT, or other parameters specific to that installer. MSI packages are usually more predictable and commonly support silent options such as /qn.

For the Windows native enrollment issue, standard users do not have the required privileges to complete enrollment through the built-in Access work or school flow. This can result in a message similar to: “You don’t have the right privileges to perform this operation.”

The recommended approach is to use the Hexnode Windows installer instead of the native Windows enrollment screen. Download the Hexnode installer from the enrollment page and run it with local administrator rights. This installs the Hexnode agent and completes enrollment without relying on the Microsoft account-style native enrollment prompt.

Regrads,
Simon Scott
Hexnode UEM

Got it. For app deployment prompts, we’ll check the install scope and silent arguments for each EXE. For the native enrollment method, temporarily making the user a local admin would work, but most of our devices are remote. Standard users also cannot open tools like netplwiz to change their own account type, so that method is hard to use at scale.

For remote devices that are not yet enrolled, Hexnode UEM cannot elevate the local user account because the device is not under management yet.

Self-service or policy-based temporary admin elevation can be useful after the device is enrolled, but it cannot solve the initial enrollment privilege requirement on an unmanaged device.

For remote Windows enrollment, the practical options are:

• Use the Hexnode installer and run it with local administrator credentials.
• Use another supported Windows enrollment method that fits your deployment workflow.
• Temporarily provide or coordinate admin access only for enrollment, then revert the account to standard user after enrollment is complete.

Once the device is enrolled, Hexnode UEM can continue managing it even if the user account is changed back to standard user.

Hi @Simon_scott,

I read your messages and I have one question.

When I want to install a Windows Store application on our computers, I obtain an UAC prompt. My users are not admin of their computers. I enrolled the computers with the ppkg option. Is it the problem?

Thank you for your help,

Hello @david_moongy ,

The PPKG enrollment method is not the cause of the UAC prompt. 

The UAC prompt appears because the application requires system-level permissions to install, but it was likely deployed in the user context. When a system-level app is deployed in the user context to an account lacking administrative privileges, Windows inherently triggers a UAC prompt. To resolve this and deploy the app silently, you need to push the app in the system context (All users). 

You have two ways to configure this in Hexnode UEM: 

1. Configure the scope in the App Inventory  

You can define the installation scope when adding the app to your Hexnode repository.  

1. Navigate to the Apps tab.
2. Click + Add Apps and select Store App.
3. Filter by the Windows platform, search for your application, and click Add next to it.
4. In the Application Installation settings window, change the User Scope to All user accounts.
5. Click Add to save it to your inventory. Once added, you can deploy it to your enrolled devices.

2. Use the Automate Tab  

Alternatively, you can use the App Distribution feature to force a system context installation without modifying your app inventory: 

1. Navigate to the Automate tab, click New Automation, and select Windows.
2. Under Triggers & Schedule, choose when the automation should run, such as selecting Apply Now to push the app immediately.
3. Move to the Choose Actions step, click the + icon next to App Distribution, select your Store app, and click Confirm.
4. Click Add next to Configure mode of deployment, then set the Installation Type to Silent Installation and the Installation scope to All users.
5. In the Assignments tab, select the required targets (such as Device group, User group, or Domains/OUs) where the app needs to be deployed.
6. Review your configurations and click Save to execute the automation.

By explicitly configuring the installation scope to “All users” or “All user accounts” using either method, the application will be installed using system-level privileges in the background, completely bypassing the UAC prompt for your standard users. 

 
Regards, 
Simon Scott 
Hexnode UEM