Run As & UAC

1Kosmos Credential Provider intercepts Run As and UAC elevation prompts, requiring MFA before elevated access is granted. From v2.0.7.0, passwordless authentication is supported for these scenarios.

---

Admin Setup

Default Behaviour

No separate journey configuration is required for Run As or UAC interception. The Credential Provider automatically intercepts Windows CredUI flows (right-click "Run as different user" and UAC elevation prompts) and applies the MFA method defined in the user's existing Adaptive Auth Journey.

Disabling 1Kosmos for CredUI Only

To disable 1Kosmos interception for Run As / UAC prompts while keeping it active for login and unlock, set the following registry value:

HKEY_LOCAL_MACHINE\SOFTWARE\1Kosmos\BlockIDCredentialProvider
Value name: Disable1KosmosOnCredUI
Value type: DWORD
Value data: 1

Enabling Passwordless Run As and RDP (v2.0.7.0+)

For passwordless authentication to function in Run As and RDP scenarios, the SmartCardCredentialProvider must be enabled on the workstation.

1. Open the registry editor and navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{8FD7E19C-3BF7-489B-A72C-846AB3678C96}

1. If the Disabled value exists and is set to 1, change it to 0.

2. If the Disabled value does not exist, no action is required — the provider is active by default.

Both the source and destination machines must have the 1Kosmos Credential Provider installed for passwordless RDP to function end-to-end.

Controlling Password Provider Visibility in CredUI

To independently control whether the standard Windows password provider is shown in CredUI prompts (Run As / UAC), set the following registry value:

HKEY_LOCAL_MACHINE\SOFTWARE\1Kosmos\BlockIDCredentialProvider
Value name: DisablePwdOnCredUI
Value type: DWORD
Value data: 1

---

User Guide

Run As Different User

1. Right-click the application you want to run with elevated or different credentials.

2. Select Run as different user.

3. In the Windows credential prompt, click More options.

4. Click Login with 1Kosmos.

5. Enter the username of the account to run the application as.

6. Select your MFA method from the available options.

7. Complete the MFA challenge (e.g., approve push, scan QR, provide fingerprint).

8. The application launches under the specified account's permissions.

UAC Elevation

1. When a UAC prompt appears (e.g., when installing software or modifying system settings), click More options.

2. Click Login with 1Kosmos.

3. Complete the MFA challenge using your configured authentication method.

4. Elevation is granted and the operation proceeds.

Passwordless Run As / RDP (v2.0.7.0+)

When the user's Adaptive Auth Journey includes a passwordless method (QR Code, Push Notification, or FIDO), those methods are available during Run As and RDP authentication — no password entry is required.

1. Initiate Run As or open an RDP connection to a remote machine.

2. At the credential prompt, click More options > Login with 1Kosmos.

3. The passwordless methods configured in your journey are presented (e.g., QR Code, Push Notification, Security Key).

4. Complete the passwordless MFA challenge.

5. Access is granted.

For RDP logins without the passwordless configuration, a password is enforced alongside any other MFA factor by default. For fully passwordless RDP, both the source machine (initiating the connection) and the destination machine (being connected to) must have the 1Kosmos Credential Provider installed and the SmartCardCredentialProvider must be enabled as described in Admin Setup.

---

Troubleshooting

Issue	Likely Cause	Resolution
1Kosmos tile not appearing in Run As prompt	SmartCardCredentialProvider is disabled	Check the registry key at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{8FD7E19C-3BF7-489B-A72C-846AB3678C96} and ensure Disabled is not set to 1; set it to 0 if present
Passwordless methods not available in Run As	User's Adaptive Auth Journey does not include a passwordless method; SmartCardCredentialProvider disabled	Update the assigned journey to include QR, Push, or FIDO; verify SmartCardCredentialProvider is enabled
UAC prompt not intercepted by 1Kosmos	Disable1KosmosOnCredUI registry key set to 1	Set Disable1KosmosOnCredUI to 0 or remove the value.
Passwordless RDP not functioning	Agent not installed on one or both machines; SmartCardCredentialProvider disabled on destination	Ensure both source and destination machines have the Credential Provider installed; verify SmartCardCredentialProvider status on the destination machine
Application does not launch after MFA completion	Incorrect alternate account credentials; account permissions insufficient	Verify the username entered in the Run As dialog is correct and has the required permissions to run the application