Restricted Groups not working with UAC

Question

I have a Restricted Group in a group policy in an organizational unit called org_unit_a. This organizational unit has all the computers.

• The restricted group is My_domain\Workstation Admins
• Has members: My_domain\settings
• Is a member of: Administrators (or Järjestelmänvalvojat in Finnish)

In the local computer:

• net localgroup "Administrators" shows the My_domain\Workstation admins as a member group
• net user /domain settings show the group membership to My_domain\Workstation Admins
• If I try to enter My_domain\settings to UAC prompt, it just slaps me in the face with:

The requested operation requires elevation

If user settings has been set as a local administrator via restricted groups then why Windows doesn't accept those credentials when entered in the UAC prompt?

Answer 1

If user settings has been set as a local administrator via restricted groups then why Windows doesn't accept those credentials when entered in the UAC prompt?

Because that's the way UAC works.

In a nutshell, both regular users and administrative users run now with the same security context - that of an unprivileged user. As an administrative user you actually receive two tokens with identical user-specific information, a standard one and an administrative one. When you attempt to perform an action that requires administrative privileges, UAC kicks in and depending on its configuration prompts either for your credentials or for an approval of escalation, and then performs whatever action you originally requested using the administrative token.

In short, you are not really an administrator even when you are an administrator (User Account Control Overview).

You can modify how "noisy" User Access Control - What are User Account Control settings?