Allow Non local Administrator to update Lacerte

[Lansend]

To combat Ransomware, we are attempting to setup users without local Administrator rights. Users can open Lacerte and QuickBooks, however they cannot update either application. From what we understand Lacerte releases updates just about every week and more often during tax season.

As a work around we created additional icons to the application which run the application as an Administrator. The idea being that when Lacerte prompts for an update. They close Lacerte, Open Lacerte using the script below. The first time the password needs to be provided, however subsequent use does not require providing the password, the “savecred” provides the password.

C:\Windows\System32\runas.exe /savecred /user:DomainName\Administrator C:\Lacerte\18tax\w18tax.exe

C:\Windows\System32\runas.exe /savecred /user:Local Administrator C:\Lacerte\18tax\w18tax.exe

Problem is that regardless of whether you use a domain Administrator or a local Administrator, the above scripts do not see Mapped network drives.

We set Group Policy based on the following article to no avail.

https://support.microsoft.com/en-us/help/3035277/mapped-drives-are-not-available-from-an-elevated-pr...

This is obviously a Windows issue , but having said that , has any other Lacerte Administrator dealt with this issue and resolved it ?

[qbteachmt]

Your examples show you are using the C:, so what is on the mapped drive that needs updating? Have you tried substituting the UNC for the mapped drive letter? Is there no one that can log into the network system as Admin to do the updates for your distributed users?

I don't use Lacerte; I support many QB clients. I like to install for All Users, and set the program icon to Run as Admin. The only issue I have run into is when someone uses the Windows Defender setting for controlling ransomware by setting protected folders. They need to exclude the QB program folders from that protection, or the update fails.

When a program gets updates through the "backside server" connection, it's unlikely you would see ransomware.

[waymck]

I've run into the same issue. Gave everyone full control of the Lacerte directory, files. The Lacert directory under common files. Without resolution.

Tried the runas with an administrator account command line in the program shorcut. Lacerte cannot find the network drive. Hit cancel at "do you want to reconfigure". The next window successfully browses to the network drive and files. Program updates. Close the application. Launch it and again it cannot find the network drive.  Worked with support for 3 hours with no solution.

Tried launching the program through a task with elevated permission. The program fails to launch.

With 2-3 updates per day during Tax season, requiring administrator privileges to update the application files is ludicrous. 

I've started digging through a Process Monitor log that I created to examine Access Denied and work on required permissions. Doing the programmers job.

[PHC_CPA]

Were you able to resolve this issue? 

[qbteachmt]

As I described, have you tried UNC instead of Mapped drive?

https://www.techwalla.com/articles/unc-path-vs-mapped-drive

[PHC_CPA]

I am already using UNC for Lacerte so that does not resolve the issue. Also I'm not the original poster.

[qbteachmt]

"Also I'm not the original poster."

Right; you are the third person posting in this topic, but you haven't given any specifics or added details that help put your issue into perspective, and you didn't state you tried everything already provided. A lot of people come to a topic and ask "is this resolved" when there even is a selected Solution right in the topic. So, we ask if you tried any of what is already in the topic, if it isn't explicitly stated that it was tried.

And by asking, you provided one of the missing pieces of info that would be helpful. So, asking works.

I understand the one person feels they are doing "programmer's" work; but it also is System or Network Manager work. Everyone's network is different, of course. This is a topic from going on two years of W10 updates, as well as older Lacerte. W10 is putting in many protections for ransomware, as are users. For instance, I also mentioned the protected folders provision. Are your server folders protected? Are the local folders protected?

We can only offer general help; this is not Tech Support or even Customer Support. It's peer users. Some people have more experience with computer systems, some with networking, and some, only with using Lacerte. You will get what help can be given, if someone believes they might have an idea that will help.

[PHC_CPA]

I just realized the original post is from 2019. If I'd realized that I'd probably not have bothered to reply to the post. That being said, this has been an on going issue with Lacerte since I first started supporting it 12 years ago. I have made several attempts over the years to transition away from users being local administrators but Lacerte updates continue to fail. I have protected folders provision locally and on the server but I simply want to limit the local user access and be able to run updates just like every other program I support. 

[qbteachmt]

"I have protected folders provision locally and on the server"

Which I have found to be a problem, because the updates use so many different folders. You can google this:

lacerte update folders

In case there is newer info than what you have been using for 12 years.

"just like every other program I support."

Yep; these Intuit things all run just like other Intuit things.

[pat]

There is a separate post/solution about not seeing mapped drives and a fix that has to be applied to remedy it. Could that be the problem rather than user rights?

[qbteachmt]

"Could that be the problem rather than user rights?"

Well, if the program can't see mapped drives that have required components, it won't launch. If the update can't find mapped drives, it won't update; but the user rights is because they don't want their user to be able to run the updates.

Not seeing mapped drives can be resolved.

Controlling Updates by controlling Windows users is a bit trickier, because it is Conditional.

[pat]

OK you got me to look up the fix I mentioned. So try this https://proconnect.intuit.com/community/help-articles/help/lacerte-setup-cannot-find-network-drive/0...

then run your script. 

[Charlley]

Hi,

Please I need your help. I have some .BD2 files that I urgently need to open/read but couldn't find a software to help me out. Lacerte Tax software has been recommended after some internet searches. I have initiated the prior year download but I got stuck during the software installation on my computer. At some point it wanted to retrieve the PREP file after my license confirmation, but I don't have a license. Is there a free version to this? If no free version, how can I get the license? I have been surfing Lacerte site trying to find more answers but I'm still stuck. Please your help is needed as the files I want to open are so important to me. 

Thanks

Challey

[abctax55]

@Charlley 

FREE is a four letter word to Intuit... 

You get a license by paying (a lot) for it.

Lacerte is tax prep software for professional tax preparers; are you one?

[qbteachmt]

"I have some .BD2 files that I urgently need to open/read"

Why? Anything done using Lacerte is a tax return, which you can get the transcript from the IRS.

Beyond that, there is an SDK available. Are you a programmer? A Hacker?

[PHC_CPA]

If those are Lacerte files, and I doubt they are, they are Benefit(Form 5500) client files for the years 2002 or 2012. It would be unlikely you would be able to gain access to this data unless you know a CPA that has the correct/licensed version of Lacerte. The Lacerte BDX files are also very small. The largest is 4 KB while most are only 1 KB.

[waymck]

I was never able to resolve this issue. Opened a support ticket with Inuit and there techs worked on it for quite a while before exclaiming it is not doable with Windows 10.

[CSG]

Good Afternoon  it is March 1st 2023 and we are running into the same problems with Lacerte updates.

All workstations have a local installed version of lacerte and users can open and use lacerte with no problems,  however when an update is available, they cannot update the program themselves as they are not in an administrators group.

I have to log into each workstation as a local admin or domain admin to run the lacerte updates.

Users need to be able to run updates themselves without being held up waiting on IT support.

Is there a way around this on Lacerte's side or is this a situation where IT support has to do the updates every day or make users local admins which is a security concern?

[sjrcpa]

"Is there a way around this on Lacerte's side"

Not that I've been able to find. They made this change-users must have admin rights to update Lacerte-10-15 years ago. I complained when they did, and a few times since. No change.

"is this a situation where IT support has to do the updates every day or make users local admins which is a security concern?"  Yes