> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/run-as-and-uac.md). # Run As & UAC *** ### Admin Setup **Default Behaviour** No separate journey configuration is required for Run As or UAC interception. The Credential Provider automatically intercepts Windows CredUI flows (right-click "Run as different user" and UAC elevation prompts) and applies the MFA method defined in the user's existing Adaptive Auth Journey. **Disabling 1Kosmos for CredUI Only** To disable 1Kosmos interception for Run As / UAC prompts while keeping it active for login and unlock, set the following registry value: ```bash HKEY_LOCAL_MACHINE\SOFTWARE\1Kosmos\BlockIDCredentialProvider Value name: Disable1KosmosOnCredUI Value type: DWORD Value data: 1 ``` **Enabling Passwordless Run As and RDP (v2.0.7.0+)** For passwordless authentication to function in Run As and RDP scenarios, the `SmartCardCredentialProvider` must be enabled on the workstation. 1. Open the registry editor and navigate to the following key: ```bash HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{8FD7E19C-3BF7-489B-A72C-846AB3678C96} ``` 2. If the `Disabled` value exists and is set to `1`, change it to `0`. 3. If the `Disabled` value does not exist, no action is required — the provider is active by default. {% hint style="info" %} Both the source and destination machines must have the 1Kosmos Credential Provider installed for passwordless RDP to function end-to-end. {% endhint %} **Controlling Password Provider Visibility in CredUI** To independently control whether the standard Windows password provider is shown in CredUI prompts (Run As / UAC), set the following registry value: ```bash HKEY_LOCAL_MACHINE\SOFTWARE\1Kosmos\BlockIDCredentialProvider Value name: DisablePwdOnCredUI Value type: DWORD Value data: 1 ``` *** ### User Guide **Run As Different User** 1. Right-click the application you want to run with elevated or different credentials. 2. Select **Run as different user**. 3. In the Windows credential prompt, click **More options**. 4. Click **Login with 1Kosmos**. 5. Enter the username of the account to run the application as. 6. Select your MFA method from the available options. 7. Complete the MFA challenge (e.g., approve push, scan QR, provide fingerprint). 8. The application launches under the specified account's permissions. **UAC Elevation** 1. When a UAC prompt appears (e.g., when installing software or modifying system settings), click **More options**. 2. Click **Login with 1Kosmos**. 3. Complete the MFA challenge using your configured authentication method. 4. Elevation is granted and the operation proceeds. **Passwordless Run As / RDP (v2.0.7.0+)** When the user's Adaptive Auth Journey includes a passwordless method (QR Code, Push Notification, or FIDO), those methods are available during Run As and RDP authentication — no password entry is required. 1. Initiate Run As or open an RDP connection to a remote machine. 2. At the credential prompt, click **More options > Login with 1Kosmos**. 3. The passwordless methods configured in your journey are presented (e.g., QR Code, Push Notification, Security Key). 4. Complete the passwordless MFA challenge. 5. Access is granted. {% hint style="info" %} For RDP logins without the passwordless configuration, a password is enforced alongside any other MFA factor by default. For fully passwordless RDP, both the source machine (initiating the connection) and the destination machine (being connected to) must have the 1Kosmos Credential Provider installed and the SmartCardCredentialProvider must be enabled as described in [Admin Setup](#admin-setup). {% endhint %} *** ### Troubleshooting | Issue | Likely Cause | Resolution | | ------------------------------------------------ | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 1Kosmos tile not appearing in Run As prompt | `SmartCardCredentialProvider` is disabled | Check the registry key at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{8FD7E19C-3BF7-489B-A72C-846AB3678C96}` and ensure `Disabled` is not set to `1`; set it to `0` if present | | Passwordless methods not available in Run As | User's Adaptive Auth Journey does not include a passwordless method; SmartCardCredentialProvider disabled | Update the assigned journey to include QR, Push, or FIDO; verify SmartCardCredentialProvider is enabled | | UAC prompt not intercepted by 1Kosmos | `Disable1KosmosOnCredUI` registry key set to `1` | Set `Disable1KosmosOnCredUI` to `0` or remove the value. | | Passwordless RDP not functioning | Agent not installed on one or both machines; SmartCardCredentialProvider disabled on destination | Ensure both source and destination machines have the Credential Provider installed; verify SmartCardCredentialProvider status on the destination machine | | Application does not launch after MFA completion | Incorrect alternate account credentials; account permissions insufficient | Verify the username entered in the Run As dialog is correct and has the required permissions to run the application | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/run-as-and-uac.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.