Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Windows 2008R2 server that runs our build scripts.

At the moment, it is not possible to fix our scripts so that they could run without elevation. Please don't bother. It is currently more viable to risk breaking the machine or opening a security hole than to fix all the 3rd party apps the scripts are using.

I have found 2 Local Sec Policy options that I thought I might use:

User Account Control: Admin Approval Mode for the Built-in Administrator account


User Account Control: Run all administrators in Admin Approval Mode

The second one basically switches UAC off completely, so all admin accounts will always run anything run with full elevation. (If I understand correctly.)

The first one though got my interest: Apparently the built-in admin account has the ability (its default) to always run anything fully elevated.

Is it somehow possible to enable this setting for a domain user account, so that we can run our scripts as this user, circumventing UAC completely for the scripts, but keeping UAC for all human interaction with the server?

share|improve this question

It sounds like the best way to handle is creating a OU for workstations, or for specific group of people, a Security group, and create a group policy that is linked to the OU or Security group. In which the only policy change would be the UAC options... Rather I should say, link it to the OU, and filter by the security group...

share|improve this answer
Please, someone link in a site that explains what "creating a OU for workstations" means. (I'm mainly a C++ developer and not a Windows Administrator.) – Martin Feb 24 '11 at 16:49
I apologize, i may have made the assumption too soon that you have an Active Directory. All your basics are here – Seth Feb 24 '11 at 16:55
You are able to designate different user groups such as Sales, Marketing, etc... and allow 2008 server to control those local policies which you were referring to. The OU or "Organiztion Unit" is the Sales, or Marketing.... This is not a quick fix if you don't currently have this setup, but it's the only way to manage workstation security, without having to set policies physically at a computer. – Seth Feb 24 '11 at 16:58
Do I get this correctly: I would need the help of the domain administrator for this, and this setting would then affect this domain user on all workstations? – Martin Feb 28 '11 at 15:52
You are correct. A logon script can be applied to an "OU" by means of a Group Policy. What exactly do you mean by keeping UAC for interaction with the server? Have a look at the available Group Policies for UAC How many users are you talking about running these scripts? – Seth Feb 28 '11 at 16:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.