Prevent Users from Disabling UAC

A

AdmiralNemo

New Member
I have a domain with several Vista boxen with users who are local Admins but not Domain Admins (accomplished using Restricted Groups). I need to ensure that these users do not disable User Account Control on their machines as I am sure they will be tempted to do so. Is there a way I can do this (perhaps through Group Policy)? I found several UAC-related settings and enforced them, but nothing stops them from disabling it entirely. Is there anything I can do besides the obvious choice of not granting them Administrative privileges?
 

My Computer

System One

Yes, in the group policy, you can specify to either lockout the UAC controls all together, or Force it to on. Even though they can still disable it when you force it to on, they have to restart their PCs, therefore refeshing the GPO at restart and leaving it on, no matter how many restarts.

FYI... This was all on server 2008 for me, dunno about 2003 and lower, but i'll look.

Hope that helps. (If not, just reply)
 

My Computer

System One

  • Manufacturer/Model
    HP
    CPU
    Core 2 Duo
    Memory
    4GB
    Graphics Card(s)
    Nvidia
    Monitor(s) Displays
    2
    Screen Resolution
    1280x800 ; 1440x900
    Hard Drives
    3
    160gb internal
    60gb external
    250gb external
Do you know where this policy setting is? I have been looking for a while and I don't see it with the rest of the User Account Control options in Security Options. Where should I be looking?
 

My Computer

System One

After I posted that I realized that the UAC was not being controlled by the GPO, but rather by Deepfreeze. Sorry.

I'm going to look into some options, but i do know that one is that you can specify who can open the control panel and what in the control panel they can open. So, your Admins would still have admin control, but they wouldn't be able to SEE the UAC options in the control panel, only domain admins can.

I'm going to look into this, but somehow i have my vista machines configured where some users are admins, but only my domain admin account can enable or disable UAC.

I'll post back hplefully within the next day.
 

My Computer

System One

  • Manufacturer/Model
    HP
    CPU
    Core 2 Duo
    Memory
    4GB
    Graphics Card(s)
    Nvidia
    Monitor(s) Displays
    2
    Screen Resolution
    1280x800 ; 1440x900
    Hard Drives
    3
    160gb internal
    60gb external
    250gb external
Are your admin's user profiles controlled by Active Directory or are they controlled locally?
 

My Computer

System One

  • Manufacturer/Model
    HP
    CPU
    Core 2 Duo
    Memory
    4GB
    Graphics Card(s)
    Nvidia
    Monitor(s) Displays
    2
    Screen Resolution
    1280x800 ; 1440x900
    Hard Drives
    3
    160gb internal
    60gb external
    250gb external
You could also try your hand at some scripting as well...

C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f

this is the command to enable UAC. The only way i see this playing out is this...
Have this script run at startup. If your user does go in and disable UAC, it will require a restart anyway, which will force this script to run again.

As a last resort, depending on how much access your want your admins to have, you could go in to the policy for these computers and remove the "User Accounts" option from the control panel.
 

My Computer

System One

  • Manufacturer/Model
    HP
    CPU
    Core 2 Duo
    Memory
    4GB
    Graphics Card(s)
    Nvidia
    Monitor(s) Displays
    2
    Screen Resolution
    1280x800 ; 1440x900
    Hard Drives
    3
    160gb internal
    60gb external
    250gb external
I think that's what I will do, just disable their access to the user accounts option in the control panel. When doing that, do I put "User Accounts" in the "Deny Access to these Control Panel Items" or the .cpl filename? If the latter, do you know which .cpl corresponds to User Accounts?

Anyway, thanks for all your help. I really appreciate the time you put into this for me.
 

My Computer

System One

not sure exactly, never actually done it, just seen it and am contemplating it. If my memory serves me correctly, it will either me a dropdown menu of choices or you can just enter "User Accounts."

Not sure, give it a try.
 

My Computer

System One

  • Manufacturer/Model
    HP
    CPU
    Core 2 Duo
    Memory
    4GB
    Graphics Card(s)
    Nvidia
    Monitor(s) Displays
    2
    Screen Resolution
    1280x800 ; 1440x900
    Hard Drives
    3
    160gb internal
    60gb external
    250gb external
You must log in or register to reply here.
Back
Top