1

We have a Windows 2008R2 server that runs our build scripts.

At the moment, it is not possible to fix our scripts so that they could run without elevation. Please don't bother. It is currently more viable to risk breaking the machine or opening a security hole than to fix all the 3rd party apps the scripts are using.

I have found 2 Local Sec Policy options that I thought I might use:

User Account Control: Admin Approval Mode for the Built-in Administrator account

and

User Account Control: Run all administrators in Admin Approval Mode

The second one basically switches UAC off completely, so all admin accounts will always run anything run with full elevation. (If I understand correctly.)

The first one though got my interest: Apparently the built-in admin account has the ability (its default) to always run anything fully elevated.

Is it somehow possible to enable this setting for a domain user account, so that we can run our scripts as this user, circumventing UAC completely for the scripts, but keeping UAC for all human interaction with the server?

1 Answer 1

1

It sounds like the best way to handle is creating a OU for workstations, or for specific group of people, a Security group, and create a group policy that is linked to the OU or Security group. In which the only policy change would be the UAC options... Rather I should say, link it to the OU, and filter by the security group...

5
  • 1
    Please, someone link in a site that explains what "creating a OU for workstations" means. (I'm mainly a C++ developer and not a Windows Administrator.)
    – Martin
    Feb 24, 2011 at 16:49
  • I apologize, i may have made the assumption too soon that you have an Active Directory. All your basics are here microsoft.com/windowsserver2008/en/us/ad-main.aspx
    – Seth
    Feb 24, 2011 at 16:55
  • You are able to designate different user groups such as Sales, Marketing, etc... and allow 2008 server to control those local policies which you were referring to. The OU or "Organiztion Unit" is the Sales, or Marketing.... This is not a quick fix if you don't currently have this setup, but it's the only way to manage workstation security, without having to set policies physically at a computer.
    – Seth
    Feb 24, 2011 at 16:58
  • Do I get this correctly: I would need the help of the domain administrator for this, and this setting would then affect this domain user on all workstations?
    – Martin
    Feb 28, 2011 at 15:52
  • You are correct. A logon script can be applied to an "OU" by means of a Group Policy. What exactly do you mean by keeping UAC for interaction with the server? Have a look at the available Group Policies for UAC technet.microsoft.com/en-us/library/dd835564%28WS.10%29.aspx How many users are you talking about running these scripts?
    – Seth
    Feb 28, 2011 at 16:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .