I want to send laptops out in the field, but I do not want them knowing the admin password. So, I will make a local account with admin privelages, but I will allow them to use it only with permission from my department. However, I do not want it to be used for logging in purposes, but I still want it to be used for UAC elevation when permission from me is granted. Their standard user account is part of a domain.

I went to Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment in gpedit in order to deny local logon, but it also denies the UAC elevation. Is this even possible?

  • 3
    If they all have Administrator permission they can just change the Administrator accounts password. Why do they need Administrator permissions? – Ramhound May 22 '14 at 18:30
  • 1
    I am aware of that, and I did mention that to my department, but there is nothing stopping them from using those NT password removers anyway from a boot disc. Either way, long as they have physical access to the machine, they can remove the admin password or give themselves admin access. It was a work around to allow them to do UAC things with my permission without technically giving them the actual Admin password which is against company policy. – Jon Weinraub May 22 '14 at 18:32
  • Would that block F12 access for the Dell boot menu? – Jon Weinraub May 22 '14 at 18:40
  • Good point. Because they wouldn't be reinstalling Windows if it crashes anyway despite what they think... – Jon Weinraub May 22 '14 at 18:54
  • Listen if you want to be technical about I know what they can or can't do. Nothing about being epic nonsense. Your insulting comment is more epic over anything. You are the one that mentioned how it requires BIOS access to boot off a CD so I really couldn't care less if you up or downvote this, all I asked if it was possible, obviously it wasn't, so that's it. – Jon Weinraub May 22 '14 at 19:21

You are technically logging in as the other user to perform the admin function, that's why it doesn't work.

Really though, even if you did manage to pull off what you're suggesting it still wouldn't stop them, because if they have an admin password, they can just undo whatever you do to stop them (i.e.: using runas to open the utilities to make another admin user, and then logging in with that account).

Perhaps instead, spend your time and energy on implementing remote access to the machines so you can log in and do admin things as needed, instead of giving up the admin credentials.

| improve this answer | |
  • We do have TeamViewer where I can do those sort of things, but the remote users are in the field and can be anywhere on the planet so timezones do cause a factor if they need to install a new plugin in order to do something and they cannot wait for me to login remotely. I understand the security concerns but was curious if it was possible and since I figured UAC does the running the user I figured that is why it wasn't working. As a true workaround, I can set the password and after they use it, I can remotely change it so they can't use it again. – Jon Weinraub May 22 '14 at 18:35
  • If you trust them to have an admin password, then you have to trust them not to log in with it. You need to start looking at company people-policies instead of trying to handle this via technical means like group policies. Anyhow, you asked if what you're trying to do is possible (deny login for an account, yet use it to bypass admin checks), and no its not. Perhaps if you approach it with questions about the ACTUAL problem, instead of questions about your proposed solution, you may have better luck. – Ƭᴇcʜιᴇ007 May 22 '14 at 18:48
  • Well there is no current problem, other than if they get new software they need for job function AFTER it leaves my possession they will need to have it installed. Obviously, like for inhouse installs, they send an IT ticket to schedule the time for me to install. In the field makes it more difficult, but there are scenarios where its not possible and it used to be admin for all remotes but corporate doesn't allow it but my question was more theoretical and since I got the answer I needed it is what it is. If I had an actual problem that would of been what was posted. Thanks for the help – Jon Weinraub May 22 '14 at 18:50

That's a very difficult situation. What you COULD do is set up an office VPN that the remote users connect in to and whenever they require anything installing or updating you can log in using your own account (part of an AD security group) that has been added to the local administrators group. Yes, this means a bit more work for you, but you then don't have to give any admin passwords or have local accounts...

| improve this answer | |

I was looking for something similar to this for our UPS software. At the end of day when the program closes it needs to do updates, which needs a UAC account.

I'm going to try something similar to @brianeme's answer. I'm going to try putting "shutdown -l" in HKCU\Software\Microsoft\Windows\CurrentVersion\Run and see if this will prevent them from logging in.

I know you can hold shift or control to bypass this, but it's worth a shot.

Thanks for the idea!

This seems to work decent. It logs on for a few seconds, but it doesn't really give you time to do much.

| improve this answer | |

One person on this site http://www.vistax64.com/vista-security/108026-local-administravtive-users-uac.html mentioned that replacing the shell with logoff.exe might do the trick for the local user. This site explains how to replace the shell for a user via GPO. But since you are using a local admin user, not sure if this will be something you can implement.


| improve this answer | |
  • 1
    We expect more then a link only answer here at Superuser. – Ramhound May 22 '14 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.