0

I want to create local admin accounts for some of our users, so that they are able to perform actions like bypass UAC to install software. However, I would also like to prevent them from being able to log in with their admin accounts to force them to only use their admin rights whenever it's absolutely needed. Is there a way to go about doing this in Active Directory?

closed as off-topic by Greg Askew, mdpc, Jim B, Katherine Villyard, MadHatter Jan 21 '16 at 8:56

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Jim B, Katherine Villyard, MadHatter
If this question can be reworded to fit the rules in the help center, please edit the question.

  • whenever it's absolutely needed how are we supposed to know what that means? – Greg Askew Jan 12 '16 at 20:06
  • when they need to bypass UAC to install software – yhussain Jan 12 '16 at 20:23
  • 2
    There is no (smart) way of preventing an admin from being an admin. – Ryan Ries Jan 12 '16 at 20:26
  • 1
    Possibly using the Deny Logon Locally GPO? This may still allow the privilege you are requesting if they are members of the admin group. I honestly don't know which is why I did not place this as an answer. – Nick Young Jan 12 '16 at 20:38
  • So to clarify, the user will have 2 accounts. A domain account without admin access and an admin access that isn't allowed to log into that specific computer but can be used to supersede UAC. I've tried creating a GPO that uses Deny Local Logon but when I try to use it to bypass UAC it tells me user isn't allowed to log on. Is there any way around this? – yhussain Jan 12 '16 at 23:01
2

Nothing blocks an admin from accessing the machine, that's why it's called "admin"! The mindset is wrong in the first place.

Create a dedicate admin account, and keep custody of its password using 3rd party software or yourself.

2

You can use LAPS from microsoft to manage default or custom local admin password. This tool has the ability to reset the password at next reboot.

Regards

Not the answer you're looking for? Browse other questions tagged or ask your own question.