HealthCast

XA-2394,2402—Passthrough mode shell replacement, Explorer shell may not start the desktop when logging in as an administrator

Observed: When logging into Windows as an administrative user, the default shell (explorer) is started and the standard desktop is supposed to be displayed. However, instead of the Windows desktop, only a explorer file browser is launched with no desktop. UAC may prevent replacing the appropriate registry keys for the shell because the administrative user is forced to be recognized as a normal user which denies write access to the shell key.

Workaround: Modify the permissions on the following registry key:

HKLM\Software\Microsoft\Windows NT\current version\Winlogon

Add the specific administrator account(s) to the key and set full access.

Windows 10 requires a new procedure to function properly. See the Windows 10 requirements

To establish the allowance for shell replacement enabling, configure the operation in Passthrough authentication only mode.

To customize the startup application values, open Registry Editor (regedit) and navigate to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\HealthCast\ExactAccess\startup

There are several values that are pre-populated, but can be adjusted for optimal performance:

The AutoLogoff.exe entry [02] may be removed as the client is configured for Kiosk Mode.

An entry for hciNetStatus.exe may be added (in place of autologoff [02]) as the client is configured for Locking Kiosk mode, so that the network status display appears on the Privacy Shield.

To enable, add 02:reg_sz="c:\program files (x86)\healthcast\ExactAccess\hciNetStatus.exe" hcikmlock

The example script maps drive L to a share that is based on the logged in user name by using the xanetuse.exe command installed with the ExactAccess client. It demonstrates the available environment variables and command line parameters that will be passed to the script when it is executed.

Login.bat

@Echo Off
cls
rem -the command processor receives the MAPDRIVES or UNMAPDRIVES command as the first parameter
rem -the command processor receives the XA Username and Domain as parameters
rem -the command environment ALSO contains the XAUsername XAUserDomain environment variables
rem -these can be BLANK if no previous user was logged in (at log-in, XA performs an UNMAP with no user)
set XA_UserName=%2
set XA_UserDomain=%3

echo XA_Username is %XA_UserName%
echo XA_UserDomain is %XA_UserDomain%
echo XAUserName is %XAUserName%
echo XAUserDomain is %XAUserDomain%
echo XAINSTPATH is %XAINSTPATH%
echo.

if %1==MAPDRIVES goto MAP
if %1==UNMAPDRIVES goto UNMAP
echo -invalid parameters-
goto done

:UNMAP
echo Performing %1
"%XAINSTPATH%xanetuse" l: /d
echo Unmap complete
goto done

:MAP
echo Performing %1
rem use variables to choose a drive in the script
rem provide a valid share path in the line below
"%XAINSTPATH%xanetuse" l: "\\server\users\%XAUserName%"
echo.
set el=%el%
if "%el%" EQU "1219" (
echo ERROR SESSION CREDENTIAL CONFLICT
) else (
        if "%el%" EQU "1202" (
         echo ERROR DEVICE ALREADY REMEMBERED
        ) else (
                  if "%el%" EQU "85" (
                   echo ERROR ALREADY ASSIGNED
                  ) else (
                          if "%el%" NEQ "0" (
                          echo failed to map drive - error %el%
                         )
               )  
        ) 
) 
:done
echo mapping complete

To add an application to be closed by the Logoff Cleanup, add the .exe to the WatchList. This is done by adding a key to [HKEY_LOCAL_MACHINE\SOFTWARE\HealthCast\ExactAccess\LogoffCleanup Settings\WatchList] named for the .exe to be closed. For example: To close MS Word name the key “WINWORD.EXE”.

If you need an application to close, and all prompts be suppressed, add a string value to the key created above named “Force” that will force the process to close.

To close all opened Internet Explorer windows you only need to add the following string value to the registry the following registry key (This is the default setting upon installation of the XA client):

[HKEY_LOCAL_MACHINE\SOFTWARE\HealthCast\ExactAccess\LogoffCleanup
Settings\InternetExplorer]"CloseIEBrowser"="True"

To exclude certain URLs, such as a Tracking Board, first set the "DisableCloseIE" registry setting to "true" to stop SnapApp from automatically closing all IE processes on log off, then add string values named for the URLs you wish to exclude to the ExcludedURLs registry key:

[HKEY_LOCAL_MACHINE\SOFTWARE\HealthCast\ExactAccess\
WebSSO\Sessions\Advanced Settings]
"DisableCloseIE"="true"

[HKEY_LOCAL_MACHINE\SOFTWARE\HealthCast\ExactAccess\
LogoffCleanup Settings\InternetExplorer\ExcludedURLs]"