In UNIX-like systems, normal users can obtain higher priviledges using the sudo command (or they can temporarily switch the user using su). However, with a properly configured sudoers and PAM file, you can prevent normal users from gaining higher priviledges completely, such that even if they were in possession of administrative credentials, they would have to login as that user.

In Windows UAC, whenever some application requires higher priviledged access, the currently logged in user is asked to type in the credentials of an priviledged account.

I was wondering if Windows provides a similar mechanism to sudo, to prevent normal users of getting higher access completely.

  • 1
    But even when sudo is blocked, you can still use su if you know the necessary credentials. That’s not exactly “prevented completely”.
    – Daniel B
    May 28 '18 at 9:29
  • @DanielB: You can effectively prevent users not in the wheelgroup from using su by setting auth required pam_wheel.so use_uid in PAM (specifically in /etc/pam.d/su - at least in Fedora Linux).
    – andreee
    May 28 '18 at 9:42
  • 1
    So I’ll just use another PAM service. ;) // Is this perhaps what you’re looking for?
    – Daniel B
    May 28 '18 at 9:49
  • "So I’ll just use another PAM chain." - What do you mean?
    – andreee
    May 28 '18 at 9:52

Windows will by default (in most cases) prompt for Admin credentials when an action requires elevation. This behavior is controlled by the “User Account Control: Behavior of the elevation prompt for standard users” group policy. If set to “Automatically deny elevation requests”, the prompt will not show up.

This will, however, not prevent the user from using runas or similar tools to run a program with known Admin credentials. These methods are not related to UAC. The Explorer context menu entry can be disabled using the HideRunAsVerb DWORD at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

To fully harden a system, you need to use AppLocker to prevent execution of all unknown/undesired software.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.