Why some computers let basic domain user administrators

Question

I do not understand why on some computers windows doesn't prompt for admin credentials to do a software installation for example, no matter of the user privilege.

Computers are on windows 7. Some of them prompt correctly and some don't.

I checked the gpresult and the computer management and i saw nothing specific.

I've been struggling with this too long. Did someone experienced the same issue?

Thanks.

Answer 1

http://windows.microsoft.com/en-us/windows/turn-user-account-control-on-off#1TC=windows-7

To turn UAC on or off

Open User Account Control Settings by clicking the Start button Picture of the Start button, and then clicking Control Panel. In the search box, type uac, and then click Change User Account Control settings.

Do one of the following:

• To turn off UAC, move the slider to the Never notify position, and then click OK. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation. You will need to restart your computer for UAC to be turned off.

• To turn on UAC, move the slider to choose when you want to be notified, and then click OK. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

Try running the following VBscript on both machines. I use this as part of my BGINFO background to help me remember the setting of any given machine.

dim base, regELUA, regCPBA, regCPBU, regPOSD

base = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\"

Set objShell = CreateObject("WScript.Shell")
regELUA = objShell.RegRead(base & "EnableLUA")
regCPBA = objShell.RegRead(base & "ConsentPromptBehaviorAdmin")
regCPBU = objShell.RegRead(base & "ConsentPromptBehaviorUser")
regPOSD = objShell.RegRead(base & "PromptOnSecureDesktop")

' wscript.echo "EnableLUA:                 " & vbtab & regELUA
' wscript.echo "ConsentPromptBehaviorAdmin:" & vbtab & regCPBA
' wscript.echo "ConsentPromptBehaviorUser: " & vbtab & regCPBU
' wscript.echo "PromptOnSecureDesktop:     " & vbtab & regPOSD

if (regELUA = 1 and regCPBU >= 1 and regCPBU <= 3 and regCPBA = 2) then
    strUSER  = "Always Notify"
    strADMIN = "Always Notify"
elseif (regELUA = 1 and regCPBU >= 1 and regCPBU <= 3 and regCPBA = 5) then
    strUSER  = "Always Notify"
    strADMIN = "Only Notify on Program Change"
elseif (regELUA = 0 and regCPBU >= 1 and regCPBU <= 3 and regCPBA = 0) then
    strUSER  = "Always Notify"
    strADMIN = "Disabled"
elseif (regELUA = 0 and regCPBU = 0 and regCPBA = 0) then
    strUSER  = "Disabled"
    strADMIN = "Disabled"
else
    strUSER  = "Unknown"
    strADMIN = "Unknown"
end if

if refPOSB = 1 then
    strDIMDESK = " & Dim Desktop"
elseif refPOSB = 0 then
    strDIMDESK = " & Do Not Dim Desktop"
end if

if strADMIN = "Disabled" or strADMIN = "Unknown" then
    strValA = "Admins:" & vbtab & strADMIN
else
    strValA = "Admins:" & vbtab & strADMIN & strDIMDESK
end if
if strUSER = "Disabled" or strUSER = "Unknown" then
    strValU = "Users:" & vbtab & strUSER
else
    strValU = "Users:" & vbtab & strUSER & strDIMDESK
end if


strName = "User Account Control (UAC):"
strValue = strValU & vbcrlf & vbtab & strValA
bginfo = strName & vbcrlf & vbtab & strValue

wscript.echo bginfo

Answer 2

It's probably this setting (or another UAC setting, depending on context). Quote taken from Local Security Policy on my Win7 machine. If it's not defined in GPO, it might be different on the local security policy of the different machines, so you should define all of the UAC settings via GPO.

User Account Control: Detect application installations and prompt for elevation

This policy setting controls the behavior of application installation detection for the computer.

The options are:

• Enabled: (Default for home) When an application installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.

• Disabled: (Default for enterprise) Application installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies such as Group Policy Software Installation or Systems Management Server (SMS) should disable this policy setting. In this case, installer detection is unnecessary.