PeteBoyd
Hi. OpenVPN 2.3.10 claims "The Windows installers now bundle OpenVPN-GUI 10, which automatically requests administrator privileges using UAC, instead of launching as a normal user and then failing at route creation time." However I find that if using my Debian 7 Samba domain account on Windows 7 Pro, which is a limited / restricted user account, then it doesn't give the UAC prompt. If I login using a local limited / restricted user account then it does give the UAC prompt.
You probably know the obvious signs of running OpenVPN-GUI without being admin, but for completeness this is from the log:
Tue Jan 12 13:34:33 2016 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jan 4 2016
Tue Jan 12 13:34:33 2016 Windows version 6.1 (Windows 7)
Tue Jan 12 13:34:33 2016 library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.09
Enter Management Password:
Tue Jan 12 13:34:33 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341
Tue Jan 12 13:34:33 2016 Need hold release from management interface, waiting...
Tue Jan 12 13:34:33 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341
Tue Jan 12 13:34:33 2016 MANAGEMENT: CMD 'state on'
Tue Jan 12 13:34:33 2016 MANAGEMENT: CMD 'log all on'
Tue Jan 12 13:34:33 2016 MANAGEMENT: CMD 'hold off'
Tue Jan 12 13:34:33 2016 MANAGEMENT: CMD 'hold release'
Tue Jan 12 13:34:38 2016 MANAGEMENT: CMD 'password [...]'
Tue Jan 12 13:34:38 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jan 12 13:34:38 2016 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Jan 12 13:34:38 2016 UDPv4 link local: [undef]
Tue Jan 12 13:34:38 2016 UDPv4 link remote: [AF_INET]XX.XX.XX.XX:1194
Tue Jan 12 13:34:38 2016 MANAGEMENT: >STATE:1452605678,WAIT,,,
Tue Jan 12 13:34:38 2016 MANAGEMENT: >STATE:1452605678,AUTH,,,
Tue Jan 12 13:34:38 2016 TLS: Initial packet from [AF_INET]XX.XX.XX.XX:1194, sid=b41c9082 5e3f943e
Tue Jan 12 13:34:38 2016 VERIFY OK: depth=1, C=UK, O=XXX, CN=XXX, emailAddress=XXX
Tue Jan 12 13:34:38 2016 VERIFY OK: nsCertType=SERVER
Tue Jan 12 13:34:38 2016 VERIFY OK: depth=0, C=UK, O=XXX, CN=XXX, emailAddress=XXX
Tue Jan 12 13:34:43 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jan 12 13:34:43 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 12 13:34:43 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jan 12 13:34:43 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 12 13:34:43 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Tue Jan 12 13:34:43 2016 [firewall] Peer Connection Initiated with [AF_INET]XX.XX.XX.XX:1194
Tue Jan 12 13:34:45 2016 MANAGEMENT: >STATE:1452605685,GET_CONFIG,,,
Tue Jan 12 13:34:46 2016 SENT CONTROL [firewall]: 'PUSH_REQUEST' (status=1)
Tue Jan 12 13:34:46 2016 PUSH: Received control message: 'PUSH_REPLY,route 192.168.254.0 255.255.255.0,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.254.1,dhcp-option WINS 192.168.254.30,route-gateway 10.0.10.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.0.10.2 255.255.255.0'
Tue Jan 12 13:34:46 2016 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jan 12 13:34:46 2016 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jan 12 13:34:46 2016 OPTIONS IMPORT: route options modified
Tue Jan 12 13:34:46 2016 OPTIONS IMPORT: route-related options modified
Tue Jan 12 13:34:46 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Jan 12 13:34:46 2016 ROUTE_GATEWAY 10.0.5.1/255.255.255.0 I=11 HWADDR=XX:XX:XX:XX:XX:XX
Tue Jan 12 13:34:46 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jan 12 13:34:46 2016 MANAGEMENT: >STATE:1452605686,ASSIGN_IP,,10.0.10.2,
Tue Jan 12 13:34:46 2016 open_tun, tt->ipv6=0
Tue Jan 12 13:34:46 2016 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{XXXXXXXXXXXXXXX}.tap
Tue Jan 12 13:34:46 2016 TAP-Windows Driver Version 9.21
Tue Jan 12 13:34:46 2016 Set TAP-Windows TUN subnet mode network/local/netmask = 10.0.10.0/10.0.10.2/255.255.255.0 [SUCCEEDED]
Tue Jan 12 13:34:46 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.0.10.2/255.255.255.0 on interface {XXXXXXXXXXXXXXX} [DHCP-serv: 10.0.10.254, lease-time: 31536000]
Tue Jan 12 13:34:46 2016 Successful ARP Flush on interface [14] {XXXXXXXXXXXXXXX}
Tue Jan 12 13:34:51 2016 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Tue Jan 12 13:34:51 2016 MANAGEMENT: >STATE:1452605691,ADD_ROUTES,,,
Tue Jan 12 13:34:51 2016 C:\Windows\system32\route.exe ADD 192.168.254.0 MASK 255.255.255.0 10.0.10.1
Tue Jan 12 13:34:51 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Jan 12 13:34:51 2016 Route addition via IPAPI succeeded [adaptive]
Tue Jan 12 13:34:51 2016 Initialization Sequence Completed
Tue Jan 12 13:34:51 2016 MANAGEMENT: >STATE:1452605691,CONNECTED,SUCCESS,10.0.10.2,XX.XX.XX.XX
THIS ONLY HAPPENS WHEN OPENVPN GUI IS NOT TOLD TO RUN AS AN ADMINISTRATOR:
Tue Jan 12 13:38:30 2016 C:\Windows\system32\route.exe DELETE 192.168.254.0 MASK 255.255.255.0 10.0.10.1
Tue Jan 12 13:38:30 2016 Route deletion via IPAPI succeeded [adaptive]
Tue Jan 12 13:38:30 2016 Closing TUN/TAP interface
Tue Jan 12 13:38:30 2016 SIGTERM[hard,] received, process exiting
Tue Jan 12 13:38:30 2016 MANAGEMENT: >STATE:1452605910,EXITING,SIGTERM,,
This isn't saved in the log, but if I copy and paste it whilst the log is scrolling by, then I see this log which differs in content, from the point of "Notified TAP-Windows driver to set a DHCP IP/netmask of..." it instead just has:
Mon Apr 04 16:17:35 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.0.10.3/255.255.255.0 on interface {88758808-D8AF-4B5D-A113-8329B15FEFB7} [DHCP-serv: 10.0.10.254, lease-time: 31536000]
Mon Apr 04 16:17:35 2016 NOTE: FlushIpNetTable failed on interface [14] {88758808-D8AF-4B5D-A113-8329B15FEFB7} (status=5) : Access is denied.
Thanks
