How do I get rid of annoying UAC Prompt - Windows 10 usage

Hello Folks, I’m a newbie here, and am trying to completely automate the installation of Keyman Desktop with no annoying UAC prompting… I downloaded the free version of Keyman Desktop 10.0 package with Galaxie Greek/(Mnemonic) Hebrew Keyboards. In order to get the software to automatically deploy successfully across our University Windows 10 cluster machines, I extracted the contents of the exe file. I then created a powershell script in SCCM for automated deployment, that does the following:

  1. Runs the msi to install the software;
  2. Runs Kmshell silently with the “–I <keyboard.kmp> -s” options

The whole thing works fine – the software installs along with the keyboards under the system account. The only problem is, when a standard user launches the application, they get a UAC prompt “Do you want to allow this app to make changes to your device?” I can cancel this as a standard user by selecting “No” and the software does work subsequently, but this is not really acceptable in our clusters.I did find that, when I log in as administrator and check the “Start When Windows starts” box in the Keyman Desktop Configuration, then log off and back on as a standard user, this UAC prompt disappears from subsequent user logons. I really need to get rid of this UAC prompting permanently and automatically. I cannot see how to do this. It’s as if the program has been designed specifically with users running as administrators in mind, which is unacceptable in our student environment. Has anyone seen this behaviour before under WIndows 10, and is there a solution?

Yes, that UAC prompt should not be occurring. Keyman does not normally prompt for UAC when starting; the only times UAC prompts occur are during install, uninstall and adding/removing keyboards (which Windows does system-wide, although the loaded keyboards are per-user).

I have not seen this behaviour before. I will try and run a test on a VM here today, but I don’t have SCCM setup (nor an Active Directory domain) here so will not be able to replicate your environment completely. If you can, could you send me a diagnostic report (

Also helpful would be to discover whether Keyman is triggering a post-install action unexpectedly, which you may be able to discover by using Process Monitor to find the command line of the kmshell.exe / keyman.exe executions.

I was able to reproduce the issue here. When you install the .msi directly, there are some post-installation tasks that don’t run (which the .exe normally does for you).

The command to run is:
kmshell.exe -firstrun=InstallDefaults,StartWithWindows,CheckForUpdates

You can leave out any of the options InstallDefaults, StartWithWindows, and CheckForUpdates if you don’t want them; they apply only in the user account.

  • InstallDefaults resets all the configuration for Keyman to the default settings.
  • StartWithWindows adds Keyman to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key.
  • CheckForUpdates tells Keyman to check online for an update once a week.

kmshell -firstrun should be run twice, first as Administrator, and then again in the user account.

Hi Marc_keyman, many thanks for looking at this. I did run procmon but not on the install, may try this if I get the chance today. And I’ll look at setting up those post install tasks. Can the “StartWithWindows” option just be set to run at logon for any user (which may then fix the issue?) I really don’t want to have to run the program as administrator at all, just add this at logon for all users.

You’ll need to run kmshell -firstrun just once as administrator in order to complete the installation (this is mostly related to upgrade tasks but still needs to be run even for clean installs). Just add a line to your powershell script for that.

In terms of the per-user setup you can either do that by adding a registry entry directly (HKCU\Software\Microsoft\Windows\CurrentVersion\Run Keyman=…\kmshell.exe) or you can use the kmshell -firstrun=... method running under the user’s profile in order to configure. However I don’t think that SCCM will run that early enough in the login process for it to take effect for starting Keyman with Windows.

Hello Marc, I found that by simply running the kmshell.exe with -firstrun parameter you suggested, as the last action in my powershell installation script actually solved the problem - the program installs and logging on a standard user and running keyman works without the UAC prompt appearing. I did not explicitly set Keyman to run at login via any registry setting in the script, though I did consider it. I’ll see what happens when more ‘live,’ users start to use the program!

I have really appreciated your help with this! Many, many thanks.

1 Like

Glad I was able to assist!