UAC Prompt when using Start-ADTProcessAsUser

The Toolkit General Discussion
1

Hi
This is on a business environment, Windows 11 laptops with Intune\PMPC deployments.

I'm writing a script to uninstall Chrome that users have installed themselves without admin rights, so the app is in their AppData Local folders. Google are really sneaky with their installer as it allows users to install without admin (well they could until I blocked the downloads) but cannot be uninstalled cleanly as it's under the user profile.

So I need to uninstall the app under the User logon. I did do a script that basically ripped out Chrome registry keys, files, killed off task schedules etc but its messy and not good practice.

I'm using PSADT v4, done the usual script to find the setup.exe location and then tried to uninstall using Start-ADTProcessUser. But when I do, its prompting for UAC creds but does not accept any user\admin credentials. If I cancel out the UAC, the script continues and says completed but when I check, Chrome is still installed and the log shows errors.

I have tried various methods - usually I do not specify the username as I think PSADT uses the current console user. But I tried this:-

Start-ADTProcessAsUser -UserName $LoggedOnUser.NTAccount -FilePath "$UninstPath" -ArgumentList "--uninstall --system-level --multi-install --force-uninstall"

which prompts for UAC and on cancelling, I got this is in the log

Start-ADTProcessAsUser -UserName $LoggedOnUser.NTAccount -FilePath "$UninstPath" -ArgumentList "--uninstall --system-level --multi-install --force-uninstall"

which prompts for UAC and on cancelling, I got this is in the log

**[Uninstall] :: An unhandled error within [invoke-appdeploytoolkit.ps1] has occurred.
Error Record:

Message : Execution failed with exit code [22].

FullyQualifiedErrorId : ProcessExitCodeError,Start-ADTProcessAsUser
ScriptStackTrace : at Start-ADTProcess, C:\installers\uninstall-chrome\PSAppDeployToolkit\PSAppDeployToolkit.psm1: line 22393
at Start-ADTProcessAsUser, C:\installers\uninstall-chrome\PSAppDeployToolkit\PSAppDeployToolkit.psm1: line 22844
at Uninstall-ADTDeployment, C:\installers\uninstall-chrome\invoke-appdeploytoolkit.ps1: line 291
at , C:\installers\uninstall-chrome\invoke-appdeploytoolkit.ps1: line 467
at , : line 1

TargetObject : Process : System.Diagnostics.Process (setup)
LaunchInfo : ProcessLaunchInfo { FilePath = C:\Users\hylandk\AppData\Local\Google\Chrome\Application\144.0.7559.97\Installer\setup.exe, ArgumentList = System.Collections.ObjectModel.ReadOnlyCollection`1[System.String], WorkingDirectory = C:\Users\hylandk\AppData\Local\Google\Chrome\Application\144.0.7559.97\Installer, RunAsActiveUser = RunAsActiveUser { NTAccount = CAREERSSCOTLAND\hylandk, SID = S-1-12-1-1374557309-1198881816-4004264339-2024299956, UserName = hylandk, DomainName = CAREERSSCOTLAND, SessionId = 3 }, UseLinkedAdminToken = False, UseHighestAvailableToken = False, InheritEnvironmentVariables = False, ExpandEnvironmentVariables = False, DenyUserTermination = False, InheritHandles = False, UseUnelevatedToken = False, UseShellExecute = False, Verb = , CreateNoWindow = False, WaitForChildProcesses = False, KillChildProcessesWithParent = False, StreamEncoding = System.Text.SBCSCodePageEncoding, WindowStyle = , ProcessWindowStyle = , PriorityClass = , CancellationToken = , NoTerminateOnTimeout = False }
CommandLine : "C:\Users\hylandk\AppData\Local\Google\Chrome\Application\144.0.7559.97\Installer\setup.exe" --uninstall --system-level --multi-install --force-uninstall
ExitCode : 22
StdOut : {}
StdErr : {}
Interleaved : {}

PositionMessage : At C:\installers\uninstall-chrome\invoke-appdeploytoolkit.ps1:291 char:17
+ ... Start-ADTProcessAsUser -UserName $LoggedOnUser.NTAccount ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~**

If I remove the UserName parameter, I again get UAC prompt and cancel out with similar log error and an error 60001

[Finalization] :: [IDSTeam_RemoveGoogleChrome_1.1_x64] uninstall completed in [19.2966429] seconds with exit code [60001].

So am I misunderstanding what Start-ADTProcessAsUser can do or am I just using it incorrectly?

Script is being run with psexec -s to reflect System install under Intune

Any assistance appreciated

Thanks
Kevin

2

I would suggest you don't reinvent the wheel.
Your script may not be working because you are running the script as SYSTEM via psexec, but you do not state whether you Intune deployment is targetted in the SYSTEM context or the logged on user.

image
image774×160 7.46 KB

I'd recommend you have a look at the Silent Install HQ website it has a vast number of examples apps that can be installed / uninstalled with PSADT
There is one for Chrome (although written originally for PSADT 3.8.4), it has some of the code that should work for you in the uninstall section - albeit you may need to make tweaks for compatibility with PSADT v4.x

There is one other thought, you may need to set RequireAdmin as True in your $adtSession parameters in your script, for this to work.

$adtSession = @{
    # App variables.
    ...
    RequireAdmin = $true

    ...
}
1 Like
3

Hi Adrian
Thanks for the reply

I’ve not even gotten as far as testing a deployment in Intune yet as I cannot get a successful result out with the Intune world. I get the same errors whether I run it with PSEXEC or an Admin account

And I’m well aware of Jason’s most excellent script as I have used them many a time before either direct use or as inspiration for solving similar issues.
However, the v3.8 versions on Silent Install HQ is behaving exactly the same as my re-jigged v4 version i.e. prompting for UAC credentials after the script has started. The scripts did work on the versions of Chrome Jason stated in the documentation, but Chrome has evolved since then so it’s entirely possible that things have changed on the Chrome setup to stop the script working now.

I’ve tried the uninstall string in admin CMD or PowerShell sessions and it fails as well however this is usually because Chrome is very quick at restarting its services or auto repairing files (Error 19 or 22)

I may just have to use the messy rip-it-all-out script to get this task completed

Thank you

4

Did you try including the above in your PSADT v4 script?

1 Like
5

Yes - Already in the script

AppSuccessExitCodes = @(0)
AppRebootExitCodes = @(1641, 3010)
AppProcessesToClose = 'googleupdate', 'chrome', 'GoogleCrashHandler', 'GoogleCrashHandler64' 
AppScriptVersion = '1.0.0'
AppScriptDate = '01/21/2026'
AppScriptAuthor = 'KH'
RequireAdmin = $true

Thanks

6

Hi

I changed the Start-ADTProcessAsUser comnand to rule out parameters due to the use of variables

If I used the actual path for the Chrome setup.exe and CMD.exe then Chrome gets uninstalled, but I do still get an Error 19 and then a 60001 but it’s a step in the right direction I guess!

CommandLine : "C:\windows\system32\cmd.exe" /C "C:\Users\KH\AppData\Local\Google\Chrome\Application\144.0.7559.97\Installer\setup.exe --uninstall --user-level --multi-install --force-uninstall"
                        ExitCode    : 19
                        StdOut      : {}
                        StdErr      : {}
                        Interleaved : {}
7

You're on the right path here. What I'd be doing is:

Start-ADTProcessAsUser -FilePath cmd.exe -ArgumentList "/c `"start /wait `"C:\Users\KH\AppData\Local\Google\Chrome\Application\144.0.7559.97\Installer\setup.exe`" --uninstall --user-level --multi-install --force-uninstall`""

Proxying through the command prompt and using start /wait will trigger a shell execution as the user, necessary for a UAC prompt to fire. While we have -UseShellExecute for Start-ADTProcess, this is because there's an API for the current user. There's no way to call ShellExecuteEx() for another user.

1 Like