I want to create local admin accounts for some of our users, so that they are able to perform actions like bypass UAC to install software. However, I would also like to prevent them from being able to log in with their admin accounts to force them to only use their admin rights whenever it's absolutely needed. Is there a way to go about doing this in Active Directory?
closed as off-topic by Greg Askew, mdpc, Jim B, Katherine Villyard, MadHatter Jan 21 '16 at 8:56
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Jim B, Katherine Villyard, MadHatter
Nothing blocks an admin from accessing the machine, that's why it's called "admin"! The mindset is wrong in the first place.
Create a dedicate admin account, and keep custody of its password using 3rd party software or yourself.
You can use LAPS from microsoft to manage default or custom local admin password. This tool has the ability to reset the password at next reboot.