Adding a policy for using the uiAccess enabled It2Me binary on Windows

components/policy/resources/policy_templates.json

Index: components/policy/resources/policy_templates.json
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 71ba1845825d856c12a133511fb426193c8e9411..fb87902d9e618577e20cfd97d121e5e3b2067f0c 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -137,7 +137,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 343
+#   For your editing convenience: highest ID currently used: 344
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -998,6 +998,23 @@
 
           The value is parsed as a JSON dictionary of policy name to policy value mappings.''',
         },
+        {
+          'name': 'RemoteAccessHostAllowUiAccessForRemoteAssistance',
+          'type': 'main',
+          'schema': { 'type': 'boolean' },
+          'supported_on': ['chrome.win:55-'],
+          'features': {
+            'dynamic_refresh': False,
+            'per_profile': False,
+          },
+          'example_value': True,
+          'id': 344,
+          'caption': '''Allow remote users to interact with elevated windows in remote assistance sessions''',
+          'tags': [],

[bartfab (slow), 2016/08/29 12:57:31]

It would seem that at least 'system-security' and 'admin-sharing' are
appropriate here.

[joedow, 2016/08/29 22:44:40]

I think system-security is a good call, admin-sharing doesn't quite apply as
this doesn't allow administrators any additional rights/privileges.

+          'desc': '''If this setting is enabled, the remote assistance host will be run in a process with <ph name="UIACCESS_PERMISSION_NAME">uiAccess</ph> permissions.  This will allow remote users to interact with elevated windows on the local user's desktop.
+
+          If this setting is disabled or not configured, the remote assistance host will run in the user's context and remote users cannot interact with elevated windows on the desktop.''',
+        },
       ],
     },
     {