Zoom MSI prompting for admin credentials after installed with admin credentials

[vgonzalez]

We are deploying Zoom to all of our workstations and have noticed that zoom is asking for admin credentials, assuming it is from the independent dataports setting, but we are installing the MSI with SCCM to the system context with admin credentials, so it should have all of the permissions to install with the independent dataports switch. We are currently rolling out 5.8.4 x64. If the users dismiss the admin prompt zoom still seems to work just fine but will keep promting until the credentials are entered. Is anyone else experiencing the same issue?

How can I check if the independent dataport flag has been enabled? I think I saw it mentioned enabling that requires admin privileges. 

msiexec /i "ZoomInstallerFull.msi" /norestart /lex c:\temp\zoom5.8.4.log ZConfig="nogoogle=1;nofacebook=1;ZSSOHOST=VanityDomain" ZoomAutoStart=true IntegrateZoomWithOutlook=1 EnableIndependentDataPort=1 MSIRESTARTMANAGERCONTROL="Disable" /q

[BrentG-ZP]

I'm not familiar with the DataPort switch but in the guide here it's talking about network ports: 

https://support.zoom.us/hc/en-us/articles/201362163-Mass-deployment-with-preconfigured-settings-for-...

EnableIndependentDataPort

If enabled, the client will use the following ports for media transmission: Audio: 8803 Screen share: 8802 Video: 8801

Did you enable "Silent Install" ? This should allow the install to happen in the background with no pop-ups from the user side:

Silent install

Installs the client without user interaction, any install windows, or immediate restart

msiexec /i ZoomInstallerFull.msi /quiet /qn /norestart /log install.log

Give that a try and let me know if its working for you.

[Professor_Zoom]

Hi vgonzalez, if BrentG-ZP's suggestion didn't help, I have a few follow-on questions:

1) When exactly are the end users receiving the prompt for creds?  During install, or post-install when attempting to run the application?

2) I personally would not enable the independent data ports switch because the Zoom client itself does such an excellent job of handling QOS without the need for network configuration.  However, if you choose to implement the switch, this alone should not be causing the users to see the admin prompt.  It's simply a registry setting.  These settings can be implemented by either using GPO administrative templates, or by using command lines as you have listed above.  It has worked better for me to modify the ZConfig section to include that switch instead of putting it at the end:

ZConfig="nogoogle=1;nofacebook=1;EnableIndependentDataPort=1;ZSSOHOST=VanityDomain"

If entered this way, you should be able to see the entry in your registry under HKLM\Software\ZoomUMX\PerInstall.

3) Why are you deploying version 5.8.4?  The latest is 5.9.6, and there have been quite a few improvements since 5.8.4.  If you are planning to maintain the same version across your org, starting with 5.8.6 there is a feature to select the cadence of AutoUpdate by selecting a “Slow” or “Fast” option (details here: https://support.zoom.us/hc/en-us/articles/4413422750861). I believe the AutoUpdate feature in general has improved with the more recent versions of the client (I suspect this could be the root of your admin prompts, depending on when they are occurring).

4) If you do plan to use SCCM to push out each version update, I think I would first attempt to use the most recent MSI, and see if that fixes the admin prompt issue for your users.  If you want to continue to try with 5.8.4, I have read where using the command line switch DisableAdvancedSharingService=true (default is to have the service enabled) can help if you are seeing Admin prompts (https://support.zoom.us/hc/en-us/articles/201362163-Mass-deploying-with-preconfigured-settings-for-W...). For the standard meeting client, it can affect the auto-updating experience, but if you are pushing versions out with SCCM, then that shouldn’t matter. This would be my last option, as I still think starting with a more recent version may be the trick.

Good luck and let us know how it goes!

[vgonzalez]

Tried with 5.9.7 using the following string.
I removed the independent data ports and I still get an admin prompt when first launching zoom as a standard users. Installing with admin rights in sccm for the system. let me know if you see anything, will probably put a ticket in on Monday if I cant figure anything.

Thanks!

msiexec /i "ZoomInstallerFull.msi" /norestart /lex c:\temp\msi.log ZConfig="nogoogle=1;nofacebook=1;ZSSOHOST=Vanity" ZoomAutoStart=true IntegrateZoomWithOutlook=1 MSIRESTARTMANAGERCONTROL="Disable" /q

[vgonzalez]

From not responding for a while, after figuring out what was triggering uac admin prompt ran across this article, which this user did some more testing that I never posted, but still not working. 

https://community.zoom.com/t5/Community-Help-Center/Following-deploy-of-MSI-end-users-get-UAC-nags-f...

[maheshkumaru]

I had same issue with Zoom VDI 5.8.4 SCCM deployment but not too many so we just had to ignore.

[juliof]

Hi, Any updates to this issue? We are facing the same UAC prompt that users can bypass and run zoom. But does't seem appropriate for users to have to deal with that. Waiting for Zoom tech support.

Thanks, J

[juliof]

Hi,

I would like to update my update. FYI thru testing I was able to figure out the latest versions of ZoomInstallerFull are the cause of the issue. I found from an old backup a very old version 5.5.4 and installed via msiexec command line. And viola runs without the UAC prompt. Also it auto-updates to latest version and no UAC prompt on the update either. I notified zoom support about this. Be well.

[vgonzalez]

Thanks for your update, with your testing Julio! the earliest version we have is 5.7. I think that version is affected, but will post up our results from testing. I will also update zoom our our ticket with this information as well.

[vgonzalez]

I was able to get 5.5.4 from zoom and I got the same issue as the newer versions. do you know if your msi install was 32 bit or 64 bit? What version of office are you using? 32 64 bit? We are using the 64bit Office 365 client

[juliof]

Hello,

We were testing the 32bit version of Zoom 5.5.4. Also using Office 2019 C2R 32bit version.

I was able to solve our issue with tech support help. Install latest with

msiexec /package ZoomInstallerFull.msi /norestart ZNoDesktopShortCut="false" ZoomAutoUpdate="true" ZConfig="AddFWException=1;IntegrateZoomWithOutlook=1"

Our error UAC prompt was C:\Users\john\AppData\Roaming\Zoom\bin\ZoomOutlookIMPlugin.exe /RegServer

Your error may be different hope this helps.

[StephenD]

Thanks!!  Adding the ZConfig="AddFWException=1;IntegrateZoomWithOutlook=1" to my command line installed and worked as it should have with no UAC prompts.  I was receiving the exact same UAC prompt message you were originally.

I also don't understand why Disable UAC prompt when logging into Zoom is not available inside the Zoom Group Policy Templates to fix existing installs.

Also as noted by others this looks to be a recent version issue.  Either the AddFWException is a recent addition or they set the wrong setting on the recent installs as the documentation notes that  AddFWException is set to Enabled, 1 by default:

https://support.zoom.us/hc/en-us/articles/201362163-Mass-deploying-with-preconfigured-settings-for-W...

[AdamCantrell]

I have uninstalled and even deployed freshly to a computer that has never had zoom before and we are not seeing any difference with AddFWException set or unset.

Reboot=ReallySuppress /qn MSIRESTARTMANAGERCONTROL="Disable" zSilentStart=true ZConfig="AddFWException=1;IntegrateZoomWithOutlook=1"

[juliof]

Hi, From what I understand from the engineering guys was that you can only use the authorized commands when using MSI installer. Traditional MSIEXEC commands like Reboot, /qn, etc should not be used. Also there is a zoom cleanup tool that support can give you that will clear up any residual zoom components and settings. I had to use this on one machine myself. Hope this helps. Be well.

[juliof]

Glad to hear it is working for you as well. Yes I too noticed that the ADDFWException is set to enabled by default so setting in CLI did not make sense. And I too went through the GPO template and found no such place to change this behavior. For us as well have had to reinstall on existing installations. Thanks, Be Well.