Hello community, Is it possible to set up an admin account to be used only to elevate access? For example, have 2 accounts, "TestAdmin" in the Administrators group and "TestUser" in the Users group. Disable log on for the "TestAdmin" account and only use it to elevate access (installing apps, change network configurations, etc...). I've done the following so far: Create the necessary accounts for the test and include them in the correct group. Add the "TestAdmin" account in Local Security Policy > Local Policies > User Rights Assignment > Deny log on locally and Deny log on through Remote Desktop Services. Add the "TestAdmin" account in Local Security Policy > Local Policies > User Rights Assignment > Act as part of the operating system and Increase scheduling priority policies. This has resulted in, TestAdmin cannot log on to the machine but, elevating access through the TestUser account fails with the following message: "Logon failure: the user has not been granted the requested logon type at this computer." Thank you.

Elevate admin rights

Carlos Yanez Baez 0

Hello community,

Is it possible to set up an admin account to be used only to elevate access?

For example, have 2 accounts, "TestAdmin" in the Administrators group and "TestUser" in the Users group. Disable log on for the "TestAdmin" account and only use it to elevate access (installing apps, change network configurations, etc...).

I've done the following so far:

Create the necessary accounts for the test and include them in the correct group.
Add the "TestAdmin" account in Local Security Policy > Local Policies > User Rights Assignment > Deny log on locally and Deny log on through Remote Desktop Services.
Add the "TestAdmin" account in Local Security Policy > Local Policies > User Rights Assignment > Act as part of the operating system and Increase scheduling priority policies.

This has resulted in, TestAdmin cannot log on to the machine but, elevating access through the TestUser account fails with the following message:

"Logon failure: the user has not been granted the requested logon type at this computer."

Thank you.

Daisy Zhou 24,666 Reputation points Microsoft Vendor

2024-07-12T11:56:19.97+00:00

Hello Carlos Yanez Baez,

Thank you for posting in Q&A forum.

Did you add the "TestUser" account in Local Security Policy > Local Policies > User Rights Assignment > Allow log on locally and Allow log on through Remote Desktop Services? You can try to add and check if it helps.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Carlos Yanez Baez 0 Reputation points

2024-07-12T12:06:28.6833333+00:00

Hi Daisy,

Thank you for your suggestion. I have added the "TestAdmin" account to both Allow log on locally and Allow log on through Remote Desktop Services policies, but I still get the same message trying to elevate access (in this instance, I'm trying to install an application).

Any further tips will be highly appreciated.
RLWA32 45,691 Reputation points

2024-07-13T17:21:46.7366667+00:00

To be clear, when a limited user account that is not a member of the administrators group attempts UAC elevation the system will present a credential prompt which requires the credentials of an administrator account. Ordinarily, if administrator credentials are provided elevation will occur and the elevated process runs under the administrator account and not under the limited user account. Denying the administrator account the right to log on is what is causing the elevation attempt to fail. With respect to user rights assignment, denying a right takes precedence over allowing it.
Daisy Zhou 24,666 Reputation points Microsoft Vendor

2024-07-16T11:18:19.0233333+00:00

Hello Carlos Yanez Baez,

Good day!

You can try to remove the "TestAdmin" account in Local Security Policy > Local Policies > User Rights Assignment > Deny log on locally or Deny log on through Remote Desktop Services, then check if it helps? If so, we cannot add the "TestAdmin" account to GPO setting "Deny log on locally" and "Deny log on through Remote Desktop Services".

Best Regards,
Daisy Zhou
RLWA32 45,691 Reputation points

2024-07-16T13:48:11.93+00:00

@Carlos Yanez Baez You now know that an Administrator account to be used for purposes of UAC elevation must be allowed to log on. If your intent is to use your own system with a limited user account you already have an Administrator account you can use for activities that require elevated privileges. There doesn't seem to be a need for a "special purpose" Administrator account.

So at this point its not clear to me what you want to accomplish. Can you elaborate further?

Share via

Elevate admin rights

Your answer