User account elevation: disable?

[ramsay]

Hi,

 

If a student runs an exe installation file it will say that it wants to make changes to the computer, they can select yes and it installs. This is very strange, as it does not ask for admin credentials and they are only a member of "domain users".

 

Is that normal? Can we disable this access either before or after they click yes? I've played around with GP settings to deny elevation requests but they do not seem to do anything.

 

Thanks

[AngryTechnician]

It sounds like they definitely have more than just regular domain user privileges. Check the local Administrators group on the workstation to see what AD groups are given membership.

[SYNACK]

If it is doing that then they have admin rights from somewhere, are you sure that they are not in the local admins group?

 

If they were limited users then it would prompt for user credentials to run under in order to perform the operation.

[Steve21]

Hi,

 

If a student runs an exe installation file it will say that it wants to make changes to the computer, they can select yes and it installs. This is very strange, as it does not ask for admin credentials and they are only a member of "domain users".

 

Is that normal? Can we disable this access either before or after they click yes? I've played around with GP settings to deny elevation requests but they do not seem to do anything.

 

Thanks

 

There's a seperate GP for that.

 

Installs are run under a "special account" not admin.

 

Try here:

 

Computer Configuration –> Administrative Templates –>Windows Components –> Windows Installer

 

Always install with elevated privileges (Think it's there anyway, but there is one)

 

Steve

[Jamo]

There's a seperate GP for that.

 

Installs are run under a "special account" not admin.

 

Try here:

 

Computer Configuration –> Administrative Templates –>Windows Components –> Windows Installer

 

Always install with elevated privileges (Think it's there anyway, but there is one)

 

Steve

 

Check the user version of the policy above, it should be set to not configured (or disabled if its configured elsewhere for some reason)

[ramsay]

Thanks for the replies. I will investigate...

[ramsay]

It turns out that the computers had "\LOCAL" listed as a local administrator. That seemed to be giving everyone local admin rights! No idea how that got there or if it's a Windows default. I put a GP setting to remove this from the local administrator group and all looks OK now.

 

Thanks

[AngryTechnician]

It turns out that the computers had "\LOCAL" listed as a local administrator.

 

I have never seen that before. Just "\LOCAL"? Not "NT AUTHORITY\LOCAL" or something?

[SYNACK]

I have never seen that before. Just "\LOCAL"? Not "NT AUTHORITY\LOCAL" or something?

 

.\Local should target the local machine