Our desktop support team grants everyone an account for daily activities in the company, and also grands a local administrator account for specific people (mostly developers) so they can install software by themselves without having to request for help from support.

The process is meant to be the following one : they use their main account on a regular basis, and if required, they input their local admin credentials in the UAC prompt.

However, I do not want them to open the desktop session as an admin and perform all their daily tasks here, for obvious security reasons.

I would like to audit on Domain Controller side the logon events to identify is some users actually use the admin account as a default account, but I cannot find any documentation related to different logon type (desktop logon VS UAC prompt).

Is there a way to perform such tasks from Windows Event Log ?

Thanks !

  • Hmm might have found something finally, not to audit but to prevent the usage : authlite.com/kb/allow-runas-but-block-interactive-logon I will try this and keep the thread updated with the results
    – MedAl
    Aug 5 at 8:42
  • No, there isn't. Further, there's been no thought given to prevent someone from opening a cmd prompt with the elevated account and leaving it open. This is a flawed strategy. The correct way to do this is to have the credentials for the elevated accounts managed/rotated when used.
    – Greg Askew
    Aug 5 at 11:47
  • @GregAskew You are perfectly right in your analysis and recommendation. However I do not have sufficient means at the time to setup such protection mechanisms. As you mention, nothing prevents them from opening elevated shell all day long, but at least they won't be clicking mail attachments or download warez with elevated rights (at least for the least hackish ones)
    – MedAl
    Aug 5 at 12:08
  • 1
    If administrator accounts are being used for email, that would be a non-technology topic for another forum. A vanilla Windows implementation is not a good platform for preventing a feral user community where everyone is an administrator from shooting the organization in the foot.
    – Greg Askew
    Aug 5 at 12:23


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.