Windows 10 1607 Shared PC - Local Administrator

[agelus]

Hello,

 

We have currently setup SharedPC mode in Windows 10 1607 through SCCM Task Sequence deployment. The SharedPC configuration was made in Windows Imaging and Configuration Designer then exported as a ppkg and imported into a SCCM Task Sequence. Which all works correctly.

However we have enabled Domain-Joined and Guest functions to allow guest logins to remove profiles on log off. We would like to setup a local administrator on the machine but this seems to get wiped out as soon as the local admin logs in. The user name and password works but it logs in as a guest account and not a local administrator.

 

My question is: Do you know how to setup a local administrator on a SharedPC scenario which computer are not joined to the domain?

 

Thanks

[KM-TechServices]

Hello -

 

I am actually playing with SharedPC mode right now too. I have a local admin account added with my Sysprep file and it seems to maintain its admin qualities, but it's still locked down with the SharedPC settings. I also found that using the runas command will let you invoke certain things that you might be blocked from otherwise.

 

Like, if you do runas /noprofile /user:%computername%\adminaccountname cmd.exe - you can get an elevated command prompt.

 

I'm not sure there should be anything that you should have to do admin wise on these systems. They're so locked down that any management should be done through SCCM. You have SCCM - why not manage all admin stuff from there? You could probably use psexec -i -s cmd.exe (sysinternals command) to get yourself into a System level command prompt too.

 

That being said, from reading about it, it sounds like if the account is created prior to SharedPC mode being enabled, it shouldn't remove it. So, possibly moving the SharedPC DISM step to later in the Task Sequence might help - after the account is created.

 

The only thing I'm trying to figure out is how to modify which folders are locked down. I have some folders on the Public desktop that don't show up because of all the Folder restriction policies and I'm trying to find a way to exempt certain folders from the policies.

 

I hope this helps.