Windows UAC prompt becomes unresponsive after credential entry (Yes/No buttons do not function) – reproducible after idle/locked state, appears service-related

That's great! Would you be able to share the framework.dll file or the script?

not sure this is the appropriate way to do it, but I could not upload a zip file directly (without renaming the extension). If you drop the .txt from the file, it's a zip folder with everything.

See script below: Code Drops.zip.txt

param(
    [switch]$Log
)
# ================================
# Configuration
# ================================
# ---- Version-Based URLs ----
$downloadUrl_2026 = #File Location "<YOUR FILE LOCATION>/Codedrop_FEB25_NCCF-1608593_2026.1.0.518/Framework.dll"   # 2026
$downloadUrl_2025 = #File Location "<YOUR FILE LOCATION>/Codedrop_FEB6_NCCF-1511813_2025.4.0.16/Framework.dll"   # 2025
$dllName     = "Framework.dll"  #Provided by N-Able
$targetDir   = "C:\Program Files (x86)\N-able Technologies\Windows Agent\bin"
$tempDir     = "C:\Temp"
$tempFile    = Join-Path $tempDir $dllName
$targetFile  = Join-Path $targetDir $dllName
$backupFile  = "$targetFile.old"
$agentPath   = Join-Path $targetDir "agent.exe"
# ================================
# Logging
# ================================
if ($Log) {
    $date = Get-Date -Format 'yyyyMMddHHmmss'
    if (!(Test-Path $tempDir)) {
        New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
    }
    $logPath = "$tempDir\Nable_DLL_Update_$date.log"
    Start-Transcript -Path $logPath -IncludeInvocationHeader
}
try {
    # ================================
    # Detect Agent Version
    # ================================
    if (!(Test-Path $agentPath)) {
        throw "agent.exe not found at expected path."
    }
    $ProductVersionRaw = (Get-Item $agentPath).VersionInfo.ProductVersion
    $ProductVersion    = [version]$ProductVersionRaw
    Write-Output "Detected Agent Version: $ProductVersion"
    if ($ProductVersion -eq "2026.1.0.518") {
        $downloadUrl = $downloadUrl_2026
        Write-Output "Using 2026 DLL package."
    }
    elseif($ProductVersion -eq "2025.4.0.16") {
        $downloadUrl = $downloadUrl_2025
        Write-Output "Using 2025 DLL package."
    }else {
        Throw "Agent version is not supported in this script."
    }
    if ([string]::IsNullOrWhiteSpace($downloadUrl)) {
        throw "Download URL is not defined."
    }
    # ================================
    # Stop Services
    # ================================
    Write-Output "Stopping Windows Agent services..."
    Stop-Service "Windows Agent Maintenance Service" -Force -ErrorAction Stop
    Stop-Service "Windows Agent Service" -Force -ErrorAction Stop
    Start-Sleep -Seconds 10
    # Ensure temp directory exists
    if (!(Test-Path $tempDir)) {
        New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
    }
    # ================================
    # Download DLL
    # ================================
    Write-Output "Downloading DLL to temporary location..."
    Invoke-WebRequest -Uri $downloadUrl -OutFile $tempFile -ErrorAction Stop
    if (!(Test-Path $tempFile) -or ((Get-Item $tempFile).Length -eq 0)) {
        throw "Download failed or file is empty."
    }
    Write-Output "Download validated."
    # ================================
    # Backup Existing DLL
    # ================================
    if (Test-Path $targetFile) {
        Write-Output "Creating backup of existing DLL..."
        Rename-Item -Path $targetFile -NewName "$dllName.old" -Force -ErrorAction Stop
    }
    # ================================
    # Replace DLL (with rollback)
    # ================================
    try {
        Write-Output "Copying new DLL into production directory..."
        Copy-Item -Path $tempFile -Destination $targetFile -Force -ErrorAction Stop
    }
    catch {
        Write-Error "Copy failed. Attempting rollback..."
        if (Test-Path $backupFile) {
            Rename-Item -Path $backupFile -NewName $dllName -Force
            Write-Output "Rollback successful."
        }
        throw "DLL replacement failed."
    }
    Unblock-File -Path $targetFile -ErrorAction SilentlyContinue
    # ================================
    # Restart Services
    # ================================
    Write-Output "Restarting services..."
    Start-Service "Windows Agent Maintenance Service"
    Start-Service "Windows Agent Service"
    Write-Output "Update completed successfully."
}
catch {
    Write-Error "ERROR: $_"
}
finally {
    # Ensure services are running
    if ((Get-Service "Windows Agent Service").Status -ne "Running") {
        Start-Service "Windows Agent Service" -ErrorAction SilentlyContinue
    }
    if ((Get-Service "Windows Agent Maintenance Service").Status -ne "Running") {
        Start-Service "Windows Agent Maintenance Service" -ErrorAction SilentlyContinue
    }
    if ($Log) {
        Stop-Transcript
    }
}

thank you so much! we'll try it out.

Can you confirm what version of windows agent this is for or maybe it doesnt matter. I ask because there are two folders in your code drops zip. One looks like four version 2025.4.0.16 and another possibly for version 2026.1.0.518 but the latest Windows agent from the vendor is 2025.4.1.2 which is the version we have installed for our clients.

Hi Andrew,

Hope you are doing well!

May I know the latest status of the query?

Hope the provided information is helpful! If it is. Free feel to hit "Accepted" for benefitting others in community having the same query too.

Chen,

I reviewed your suggestions yesterday, and have been testing yesterday and today. More testing is needed though, as results are mixed.

• I confirmed that KB5074109 is installed and present while the issue has been occurring this week. This was installed on the 18th, and I documented the issue occurring for several days after the machine had been restarted with the update installed.
• I modified the registry key indicated yesterday and tested elevating programs to see the behavior that it should have when working normally as opposed to broken. This morning, I confirmed that even with the registry change, the issue was still occurring, but with a few differences.
  • Wait chain yesterday and this morning appeared the same. Consent.exe was not listed in the resource monitor until attempting to escalate a program.
  • UAC still froze, and in once instance produced an error after crashing: "File System Error (-805306369)
    
  • Allowing the UAC to remain idle would eventually launch the escalated program after timeout (results are mixed normally)
    
  After multiple tests this morning, about 30 minutes in to investigating, the issue appeared to disappear. I did not intentionally stop any services this time, but something apparently changed for it to temporarily disappear. This is why additional testing is needed, as I expect it will reoccur after going through the normal "extended lock - unlock cycle".

Hi Andrew,

Hope you are doing well!

May I know the latest status of your additional testing?

Hope some of the above suggestions are helpful! If it is. It is highly appreciated to hit "Accepted Answer".

We are still doing testing. Since this is not currently the solution, I will not be accepting the answer yet. Thank you.

Good morning, I have an update from my testing this week. I uninstalled the N-Central Agent from my device and confirmed this morning that the UAC error has disappeared. I will continue to test on my device to make sure it does not occur over the next several days. DNS Filter is still installed on my device. Please let me know what additional testing you would like me to perform, since it appears that N-Central is having issues with something that is causing the UAC prompt to freeze up, though there could be another app interaction we have not discovered yet.