Disable RunAs Administrator option

[hsingh]

Hi Folks,

I was hoping someone might know the answer to the following please.

I'm trying to lock down games within school. I have setup a software restriction policy disabling all applications which works a treat. However, I have found that if you right click your application and run it as administrator it works (Grand Theft Auto). Any ideas how I can stop this?

All workstations running windows 7 sp1 with Server 2008R2 Enterprise

Thanks

[3s-gtech]

They should have to enter an administrator password to Run As Administrator, unless you've turned UAC off via Group Policy - with Vista I could understand doing this, but with 7 it is not a good idea!

[hsingh]

UAC is off at GPO level. Any ideas?

[3s-gtech]

Turn it on, turn it on!

[chazzy2501]

UAC should be on as it's useful. You could try this "User Configuration \ Windows Components \ Windows Explorer \ Do Not Request Alternate Credentials"

[hsingh]

Hi

It doesn't actually prompt them to enter in alternate credentials. its just works for them?

[chazzy2501]

Windows won't ask for admin creds so the action will just fail, telling you to ask for an admin.

[hsingh]

I turned UAC on to its highest level via GPO. Tested it on two workstations after two restarts and it seems to be working. Fingers crossed for the other 698 workstations I have left. Are there any pitfalls to watch out for with having UAC turned on?

[VeryPC_Tom_M]

Any older software which may require (and will fail the prompt for) admin privileges to run.. While this isn't very common any longer, any older piece of software (XP or older) could potentially be a culprit.

[3s-gtech]

It can cause some fun issues with printers, if so you'll need to enable Point and Print restrictions via GP which smooths it out. Otherwise, it does seem to protect the PCs that bit more.

[hsingh]

how about any issues with sims when it runs an upgrade on the workstation under teacher logon?

[3s-gtech]

When pushed via SOLUS3, none that I've seen. It runs as a different user. With SOLUS2, it seemed to work okay as long as teachers have write permissions to the local SIMS directory.