Hacker News Reader

> especially if you take into consideration Steam's Big Picture mode and that it needs to be usable with a controller (though perhaps the Steam Controller can also function as a regular desktop mouse, assuming it doesn't rely on Steam itself to move the cursor around - which may not work when the UAC prompt is shown - and on the other hand some older games do need to run as Administrator and/or a compatibility mode that shows a UAC prompt, so perhaps SC can work with that).

The Steam Controller has a "lizard mode" for when it can't connect to Steam where it just acts as a dumb mouse. I have no idea whether it enables that for UAC prompts, but it probably could.

I just checked, and yes, you can use Steam Controller to get through UAC prompts. The joystick mimics the arrow keys, the right trackpad moves the mouse cursor, the trigger buttons represent mouse clicks, and A is Enter.

How does Steam capture the secure desktop that displays the UAC prompt?

It doesn't. The controller simply acts as a mouse/minimal keyboard outside Steam.

So if you're using Steam streaming and the session switches to the secure desktop due to a UAC prompt, what happens... does the screen just go blank (a la VNC), leaving the remote user locked out?

Just tried. If you're already streaming, it manages to show you the prompt, but there's no way to interact with it. The mouse moves (both on the host and client), but clicks don't go through. Keyboard navigation doesn't work either.

If you try to stream something that first pops up UAC, the client just sits there waiting for it to be dealt with on the host.

Steam streaming always manages to feel half baked to me for reasons like this. Another is that it needs to unlock your screen before it can be used. So you either leave your computer unlocked, or you need to VNC into it to unlock the screen so Steam streaming works.

Every time I do that I think there must be a better way.

Yeah, i often control my machine via RDP and then streaming a game from there is a pain. Here is some script I've found to unlock the local pc, disconnecting RDP in the process:

> @powershell -NoProfile -ExecutionPolicy unrestricted -Command "$sessionid=((quser $env:USERNAME | select -Skip 1) -split '\s+')[2]; tscon $sessionid /dest:console" 2> UnlockErrors.logpp

I've not used it often and mostly given up on Steams streaming stuff. Playing simple stuff though RDP directly usually works well enough for the few times I still did that. Notably pretty much all games launch flawlessly. The drawback is it not being optimized for games, offering a notably worse performance on that front.

It actually gets even more confusing. Desktop mode (what you get when Steam is in desktop mode or you're tabbed out of big picture/TV mode) is completely separate from lizard mode (what you get when Steam isn't running or can't grab the desktop due to UAC/Secure Desktop).

That matters because desktop mode still has customizable keybindings as usual, while lizard mode is completely hard-coded. Lizard mode also (obviously) doesn't support the soft keyboard, which would otherwise have been pretty useful from the lock/login screen.

Come on folks, don't downvote a question you don't understand

The problem is that the privileged service modifies permissions of arbitrary registry keys that don't belong to the steam client. Simply checking that the path is below the steam path before calling RegSetKeySecurity would fix the problem.

Yup. It is probably a single line of code. Make it two, if they are using C# :)

Complaining about privilege escalation is not FUD.

> all they'll need to do is simply... show the UAC prompt.

Yeah, this is a good point. Not sure how many folks here play a lot of Steam games, but a ton of them install their own specific VC++ runtime redists (sometimes multiple) at first run, and each of them throw their own UAC prompt.

It's absolutely an established pattern for me to mindlessly click through 1-5 UAC prompts on first run of Steam games. (Though they're typically all Microsoft Corp signed in the prompt, which is helpful.)

>I wouldn't be surprised if this is for backwards compatibility with older games (the linked twitter "exploit" is certainly due to many games writing files in their own folders)

Maybe they should use "c:\users\all users\appdata" for this purpose instead of using "c:\program files"?

Nowadays you can install Steam on a separate drive. I have a 500GB PCIe SSD but install my more intensive games on a regular SSD and then the rest on a 1TB spin disk. So in a way you wont always install it in Program Files if you pick a new location to install.

Yeah, i never install it on Program Files myself, i always use a root level folder like C:\Steam (and a reason is UAC too, while Steam does more or less seem to bypass it, some patches and mods for older games do not always work that well if Steam is in Program FIles).

> some patches and mods for older games do not always work that well if Steam is in Program FIles).

How old? Like DOS old? Because most programs from this century should assume they were installed somewhere inside of Program Files.

If you get into running old games in modern Windows, i think you'll find that when it comes to games such assumptions are the first to fly out of the window :-P. Games tend to be among the most brittle desktop software.