I want to send laptops out in the field, but I do not want them knowing the admin password. So, I will make a local account with admin privelages, but I will allow them to use it only with permission from my department. However, I do not want it to be used for logging in purposes, but I still want it to be used for UAC elevation when permission from me is granted. Their standard user account is part of a domain.
I went to Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
in gpedit in order to deny local logon, but it also denies the UAC elevation. Is this even possible?