Programmatically execute a program using Avecto Privilege Guard?

Question

My company uses 'Avecto Privilege Guard' to control administrator access on company computers. This creates a right click context menu that when activated, runs the program in an administrator account rather than the local user's account.

The system is functional, but it's annoying because the right click option only appears on files and shortcuts - it doesn't appear when right clicking on the pinned applications or recently opened applications in the start menu. Also, it's easy to open a program that usually needs to be run in administrator mode in regular user mode.

Is there any way to call Avecto Privilege Guard programmatically - for instance, from a batch file, the command prompt, or a C application? I had a dig around in the underlying dll that I assume drives the creation of the right-click option, 'PGHook.dll', but this isn't my area of expertise and I couldn't find anything.

Solution 1

In the command line, you can call avecto as in:

avecto C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe

If you want an automated way to do it, put it in a .ps1 or a .bat

Solution 2

Running specifically programmatically doesnt really work. But, there are some things you can do.

For the pinned items in the start menu, hold shift and right click them. The Avecto - Run with Admin Rights (Audited) shortcut should show up).

But, anything you want to run with a batch file you can do, just run cmd.exe using Run with Admin Rights. You can point it to execute anything you want as far as I know. This has worked for me so far.

Solution 3

Since avecto.bat is not available anymore you can use a general program requesting elevation like Johannes Passing Elevate.exe. Then just use elevate as you has used avecto, e.g.

elevate prog.exe

or

elevate -k script.cmd

As a nice side effect it works in arbitrary environments.

Comments

[DavidPostill]

This looks like a question that is better suited to Avecto Support, especially as it seems it is easy to bypass their "Audited" admin log ...

[Oliver]

@DavidPostill It doesn't bypass it - trying to elevate with the regular windows 'Run as Administrator' option requires the correct user account.

[Kellen Stuart]

Check out my answer. You absolutely can do this programatically.

[Oliver]

Thanks, the first tip is really handy. I didn't know you could do that. Regarding the batch file, I was hoping it would be possible to automatically trigger 'Run with Admin Rights' without using the right click menu, but I guess not - I certainly haven't discovered anything since writing this question.

[Kellen Stuart]

I downvoted because you absolutely can do this programatically

[Petr Vávro]

Do you know where the avecto executable is hidden? or what is avecto aliesed to on your system? Can't find an avecto.exe that i could invoke like this.

[Kellen Stuart]

@PetrVávro The avecto command is an alias for C:\Windows\Avecto.bat. If you don't find it there, open a powershell prompt and type ls -Recurse "Avecto.bat" and it will return the path to the file (assuming you have permission to cd to the directory).

[Petr Vávro]

Thanks, but unfortunately there is no avecto.bat anywhere on my system, could you by chance post the contents of the bat somewhere?

[Kellen Stuart]

@PetrVávro Did you try that command to search for it? I'm not sure where to post it

[Sundara Prabu]

we dont see this avecto.bat in the latest versions of avecto defendpoint

[Petr Vávro]

@KolobCanyon yes i did try the search command. You could paste it on pastebin for example, or directly in here as code as an update to the answer?

[Kellen Stuart]

Sorry guys, I don't have access to a system with Avecto installed. I haven't been able to verify whether my answer still works or not, but please comment and feel free to edit my answer. It will help out others who run into this problem.