A referral was returned from the server when the exe requires admin

[aliencaocao]

I built a single file exe from a python script and passed the command line switches that require admin and remote desktop access (--uac-admin --uac-uiaccess). When i try to run the exe, windows give me error A referral was returned from the server. The only way to solve this problem was to right click on file, go to properties, compatibility, and check run as admin. Even if right-clicking the file and selecting run as admin does NOT work. ONLY the file property setting work. However, because the users of the exe is not supposed to know about software stuff, I can't expect them to do this fix themselves. Thus I would like to ask if there is any fixes that I can do on my side to permanently resolve the issue on their side. As long as it is able to be achieved by any sort of script - python or windows batch or powershell, its fine with me.

P.S. I have tried a registry editing solution which didn't work for me. (https://www.technipages.com/windows-a-referral-was-returned-from-the-server-error-fix)

[rokm]

Looks like you need to sign your program if you want to use uiAccess=true (which is what --uac-uiaccess sets):
https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/350ceab8-436b-4ef1-8512-3fee4b470c0a/problem-with-manifest-and-uiaccess-set-to-true?forum=windowsgeneraldevelopmentissues

(disabling the signature requirement via the registry/group policy that you linked probably works only with --uac-admin without --uac-uiaccess)

Also note this part from the above link:

Also, applications by default must reside in a trusted location on the hard drive (such as windows or program files) to receive the uiAccess privilege. They will still run if they are not in one of these locations, but they will not receive the privilege. You can disable this security feature through the local security policy mmc snap-in.

As noted, you can disable this via security policy (policy User Account Control: Only elevate UIAccess applications that are installed in secure locations under Computer Configuration” > “Windows Settings” > “Security Settings” > “Local Policies” > “Security Options), or corresponding registry key (EnableSecureUIAPaths in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System).

But you need signed program, either way.

[aliencaocao]

Hmm thanks for the detailed answer. I got one question though. What exact do --uac-uiaccess grant the application? I'm actually not very sure I will even need it, and judging from your answer, I should probably try not to use it. My program needs to modify windows registry, run other exes and powershell scripts as admin, install software that requires admin to install. Just judging from what I listed here, do I even need this --uac-uiaccess flag?

[rokm]

I think you need just --uac-admin, unless there's remote desktop in the play.

--uac-admin option adds <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/> to application's manifest, so that the program prompts for elevation to administrator privileges when it is started. (Details are here).

--uac-uiaccess sets uiAccess="true" (if --uac-admin is not used, then it sets level="asInvoker"); from linked page, you need this "if you want the application to bypass user interface protection levels and drive input to higher-permission windows on the desktop". I suppose Remote Desktop falls under "higher-permission windows on the desktop", which is why this needs to be set for application to be remote-desktop compatible (and I guess that's why there are stricter requirements for it).

[aliencaocao]

Ok thanks for the explanation!