M100811: ManageSoft agent user interface restrictions on Vista

Introduction

Microsoft Windows Vista introduces some issues for user interfaces displayed on managed devices. Vista has imposed a restriction via UAC (User Account Control) that stops applications that are implemented as services, or running under SYSTEM account credentials, from showing a user interface.

If services-based applications try to show a window or dialog, Vista pops up an "Interactive services dialog detection" message in the middle of the screen. This message dialog warns the user of a potential security threat, but ultimately lets the user get to the original user interface.

Managed device user interfaces not affected

The following is a list the managed device agent user interfaces that is not affected by the limitations. These user interface scenarios are unchanged on Vista:

• Any user interfaces launched through the selector. 
  This includes installing optional applications, any callouts or installers launched as part of that install, uninstalling applications, etc.
• Any user interfaces launched through user policy.
• Any user interfaces launched by manually running "mgspolicy –t machine" at the command line.
• The schedule agent: "ndschedag –o ScheduleType=machine". 
  Note: There are limitations with some things launched from the schedule agent, but schedule agent UI interactions are unchanged.
• Interactions with the reboot dialog in all scenarios.

Changed user interactions on Vista

The following scenarios exhibit changed user interactions on Vista:

• Installation agent UI with "machine policy"
• Icons in the system tray

Installation agent UI with "machine policy"

If the managed device installation agent needs to present a user interface while applying machine policy (either automatically started on a schedule or manually triggered from the schedule agent user interface), a Vista interactive services dialog will be presented instead.

This dialog tells the user that there is a message that can't be displayed on their desktop. The user can click a button to see the user interface in question. This scenario impacts most user interface operations during a machine policy. However, it does not affect the reboot dialog. As previously noted, interactions with the reboot dialog are unchanged on Vista.

The scenarios that are impacted are:

• The installation agent prompts the user for additional information, such as whether they want to postpone the installation of an application
• A third party command or run command in a package that shows a UI
• A callout that shows a UI

The user experience is as follows:

1. First, the Vista interactive services dialog is displayed.
2. The user can click "Show program details" to see which program is requesting interaction. 
   This will either be ndserv.exe in the case of an installation agent dialog, or the third party EXE in the case of a third party installer or run command.

   If the user clicks the "Why does this happen?" link in the dialog box, a message box opens explaining why the program can't display a message.

3. If the user clicks "Show me the message", they are taken to a separate full-screen desktop that only shows the UI in question. For example, if the installation agent is asking the user if they want to postpone, the installation agent UI with that question will be shown.

   The only other thing shown on the other desktop is a dialog allowing the user to return to the normal desktop. Text on this dialog reads as follows:

   Interactive services dialog detection 
   Return to your Windows desktop 
   The program will display its own window below if it still needs attention. 
   When you are done, or if you need to return to your desktop for more information, click Return now.
   --> Return now

   The idea is that the user should dismiss the UI that is showing, then click "Return now"; the installation agent will continue as normal. If they don't dismiss the client UI, then they will be left back at the initial Vista dialog on their desktop.

   If the user clicks "Remind me in a few minutes" then the interactive services dialog will be dismissed. However, the dialog will popup again in a few minutes.

   Meanwhile, the installation agent is paused, waiting for user interaction before it continues.

   Note: If the UI presented by the client has some kind of timeout countdown, that will still be active. So if the dialog dismisses itself after 10 minutes, it will still do so under Vista. This means that user has no way of ignoring the UI that is popping up. The best they can do is keeping asking to be reminded in a few minutes. Eventually they will click to see the message and will see the real UI.

Icons in the system tray

The ManageSoft icon in the tray is unavailable when applying machine policy under Vista. This means that the user is not able to modify bandwidth settings during installation of packages in machine policy.

Any UI scenarios that are meant to show the installation agent UI progress to the user will be unavailable with machine policy under Vista.

Note that if the ManageSoft client is applying a large policy and the client is set to show the UI, the following things will happen:

• The user will not see any client UI or progress.
• After a period of time, they may see the previous described Vista dialog. This is because Vista thinks it has launched a UI that is waiting on user input, when in fact it is just taking a while to apply the policy.