UAC Police

hi.

I configure The policies "UAC: Run all administrator in Admin Approval Mode"
Enable in a Domain controler.
HOW COULD I CONFIGURE A LOCAL ADMINISTRATOR TO AVOID IT CHANGE THE USER
ACCOUNT CONTROL (UAC)?

ANY RECOMMENDATION?

Not sure what you mean by configuring UAC on the DC, considering that UAC is
only available in Vista as of now.

However, it seems your question is "how do I keep local administrators from
circumventing policies set down by domain admins?"

The answer to that question is "you can't." Local administrators are gods
iwthin the realm of the computer they administer. You cannot prevent them
from doing anything.

---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/047...otectyourwi-20


"Marco" wrote:

> hi.
>
> I configure The policies "UAC: Run all administrator in Admin Approval Mode"
> Enable in a Domain controler.
> HOW COULD I CONFIGURE A LOCAL ADMINISTRATOR TO AVOID IT CHANGE THE USER
> ACCOUNT CONTROL (UAC)?
>
> ANY RECOMMENDATION?

jesper Thanks for you answer.

I want configure the next scenary:
AD - Turn ON UAC on all client's. (Run all administrators in Admin
Approval Mode: Enable )
AD - Local administrator's elevate privileges prompt for consent
(Behavior of the elevation prompt for administrators in Admin Approval Mode:
Prompt for consent )
AD - standard user elevate privileges prompt for credentials. (Behavior
of the elevation prompt for standard users: Prompt for credentials )

AND COULD NO TURN OFF BY UNCHECK BOX "Use User Account Control (UAC) to help
protect your computer"



"Jesper" wrote:

> Not sure what you mean by configuring UAC on the DC, considering that UAC is
> only available in Vista as of now.
>
> However, it seems your question is "how do I keep local administrators from
> circumventing policies set down by domain admins?"
>
> The answer to that question is "you can't." Local administrators are gods
> iwthin the realm of the computer they administer. You cannot prevent them
> from doing anything.
>
> ---
> Your question may already be answered in Windows Vista Security:
> http://www.amazon.com/gp/product/047...otectyourwi-20
>
>
> "Marco" wrote:
>
> > hi.
> >
> > I configure The policies "UAC: Run all administrator in Admin Approval Mode"
> > Enable in a Domain controler.
> > HOW COULD I CONFIGURE A LOCAL ADMINISTRATOR TO AVOID IT CHANGE THE USER
> > ACCOUNT CONTROL (UAC)?
> >
> > ANY RECOMMENDATION?

You cannot prevent a local admin from disabling UAC, or modifying how it
works. If you want to prevent people from doing so they must not be local
admins.

---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/047...otectyourwi-20


"Marco" wrote:

> jesper Thanks for you answer.
>
> I want configure the next scenary:
> AD - Turn ON UAC on all client's. (Run all administrators in Admin
> Approval Mode: Enable )
> AD - Local administrator's elevate privileges prompt for consent
> (Behavior of the elevation prompt for administrators in Admin Approval Mode:
> Prompt for consent )
> AD - standard user elevate privileges prompt for credentials. (Behavior
> of the elevation prompt for standard users: Prompt for credentials )
>
> AND COULD NO TURN OFF BY UNCHECK BOX "Use User Account Control (UAC) to help
> protect your computer"
>
>
>
> "Jesper" wrote:
>
> > Not sure what you mean by configuring UAC on the DC, considering that UAC is
> > only available in Vista as of now.
> >
> > However, it seems your question is "how do I keep local administrators from
> > circumventing policies set down by domain admins?"
> >
> > The answer to that question is "you can't." Local administrators are gods
> > iwthin the realm of the computer they administer. You cannot prevent them
> > from doing anything.
> >
> > ---
> > Your question may already be answered in Windows Vista Security:
> > http://www.amazon.com/gp/product/047...otectyourwi-20
> >
> >
> > "Marco" wrote:
> >
> > > hi.
> > >
> > > I configure The policies "UAC: Run all administrator in Admin Approval Mode"
> > > Enable in a Domain controler.
> > > HOW COULD I CONFIGURE A LOCAL ADMINISTRATOR TO AVOID IT CHANGE THE USER
> > > ACCOUNT CONTROL (UAC)?
> > >
> > > ANY RECOMMENDATION?