Yeah we have encountered this before and here is a solution for it.
When logged on to the machine as a standard user and attempting to capture an image in the EMR, you receive the message “Failed to acquire image from device” after clicking on Take Snapshot.
When capturing the events on the PC using ProcMon, you will also see the following event:
The two important pieces of information in the screenshot above are the “Result – ACCESS DENIED” and “Integrity – S-1-16-8192”. When the EMR attempts to capture a photo it utilizes the file capture.avi that is located in the root of the C:\. The user account we are using is a standard user account, and the default NTFS permissions do not allow standard users to modify the root of the C:\, resulting in receiving g Access Denied. However even after granting the user “Modify” permissions on the file you will continue to receive this same entry in ProcMon indicating “Access Denied”. The reason for this is because of the information in the Integrity column. The integrity column is only applicable for local file/registry access on Vista or higher when User Account Control (UAC) is enabled. (In this example we ran ProcMon on a Windows 8 machine, which resulted in an integrity of S-1-16-8192. This value is the equivalent of “Medium” – see here http://support.microsoft.com/KB/243330 .) Users in the “Authenticated Users” group are able to execute items at a Medium mandatory level. To view the integrity of the file C:\capture.avi we can use the tool icacls.exe. Open an elevated command prompt and run the following command – icacls c:\capture.avi
The last line of the output indicates the file currently possesses a “High Mandatory Level”. Therefore, in the files current state, a user will need to be in the local Administrators, Backup Operators, or Network Configuration Operators security groups (more information here http://msdn.microsoft.com/en-us/library/bb625963.aspx ). However, using icacls, it is better to change the file to a Medium Mandatory Level. To do this, execute the following command - icacls c:\capture.avi /setintegritylevel M
We can then execute icacls c:\capture.avi again to confirm our changes have been applied.
Now when attempting to capture an image in the EMR you should no longer receive the error message and you can successfully acquire the photo (indicated by the button Attach being available).
Posted : July 30, 2019 6:59 am
