Account type is standard user but it allows me to install software

Question

Account type is standard user but it allows me to install software

GlenTech 496

I added a trial license for Windows 365 to spin up so I could test it out as an end user. I made sure my account type was set to "standard user" which should only allow me to install apps from the Microsoft store, yet I was able to download anything from the web browser and install it without any prompt for admin credentials. I setup Zoom, Teams, Adobe reader, etc all using the .exe's I downloaded. Why is it letting me do that as a standard user account type?

2 answers

Your answer

Answer 1

Users can install any software that doesn't require admin privileges. Most software these days allow you to install per-user and don't require admin rights. Therefore any standard user can install any of these programs including Zoom and Teams. Chrome would be in this list as well.

You can confirm this by trying to install something that does require admin privileges such as Office or SQL Server.

If you want to prevent users from installing software other than the MS Store then you need to configure this in Windows. For Win 10+ this setting is under Apps. Set it to only allow MS Store apps.

Answer 2

GlenTech 496

That's odd as with a traditional on-prem domain joined machine, users that are standard users and are not local admins cannot install any software without admin credentials. Maybe a browser extension but any .exe file will prompt them for admin creds. Also, why would it say users can only install apps from the Appstore? That doesn't make any sense.

Michael Taylor 60,331 Reputation points

2023-01-06T21:43:35.12+00:00

Maybe your domain policies are enforcing that because out of the box that isn't true. A normal user can run any EXE that isn't blocked by a domain policy. If that EXE "installs" an app then that is up to the EXE. You can test this by having a domain-joined machine install Chrome or Azure Data Studio which both can be installed per-user. Note however that many domains do lock down normal user accounts so they cannot run "setup" programs but, again, that is a domain policy. AFAIK at least.
GlenTech 496 Reputation points

2023-01-06T22:00:20.007+00:00

Chrome was a bad example per se but try installing Quickbooks without admin creds and it won't work and that's out of the box on a domain joined windows 10 machine with a standard users account. No specific GPO policies set. That's the point of not giving users local admin rights, so they cannot install software and its like that as default. You would need to add the user to the local admin group for them to be allowed to install apps.
Michael Taylor 60,331 Reputation points

2023-01-06T22:18:43.193+00:00

I think we have a disconnect here. Go back to my original post. I said that if an installer supports per-user installations then a non-admin can install that program. Chrome and other apps support per-user installations and do not require admin privileges to install. Out of the box on a Windows machine any user can install the application. That's the whole point of per-user apps and why many software packages provide that option. Each user has to install the software themselves and all the files and data are stored in the user's personal area. Hence no admin privileges are needed.

Apps that are installed per-machine require admin privileges because the installer has to make changes to the machine that might impact other users. These apps require the user to be an admin and elevated. When you attempt to run the installer if you get the UAC prompt then it is a per-machine install (or per-user that requires admin privileges for some reason).

So let's go back to the app you are trying to install on the machine. When you run the installer does it trigger a UAC prompt? If it doesn't then it is a per-user install and any user can install it (assuming group policies don't block it). Again, Chrome, Zoom and Teams are good examples of this. If the installer triggers a UAC prompt then it requires admin privileges and a normal user cannot install it. This is standard Windows behavior.

If you can identify the program(s) you didn't expect to install then we can look further.
GlenTech 496 Reputation points

2023-01-07T13:33:56.757+00:00

Actually, the UAC prompt appeared each time I installed an app but just allowed me to click yes to proceed. Here is a screen record of me installing Adobe. It happened as well with Teams and Zoom.

https://www.screencast.com/t/Ul1GRblXgcBN
Michael Taylor 60,331 Reputation points

2023-01-07T18:20:39.513+00:00
While the UAC can be confusing it appears you're getting the Consent UI, not the Credentials UI. Taking a quick look at the Adobe Reader installer online it appears to require admin privileges. If that is the same version you're trying to install and you're getting the UAC prompt then the user in question is getting elevated. Are you sure you changed the user's account type AND ensured they were completely logged out (or reboot) before logging back in? Account changes don't take effect until the user is completely logged out.

Try running this code in a Powershell window.

whoami /groups

What groups is the user a member of?
GlenTech 496 Reputation points

2023-01-07T18:38:57.7+00:00

Also, I can right click on anything and select "run as admin" and just click yes so it seems like I have local admin rights but under devices it's showing I'm a standard user. MS support was no help. The lady kept thinking I wanted admin rights despite me saying over and over I do not want to let any standard user install software.

I created this account for myself as a demo before I deploy it any users as I wanted to make sure it was working properly first. It was created as a standard account, never had admin rights. Just rebooted it but the same issue.

I checked the local admin group before posting here by running "net localgroup administrators" and my user is not listed there but it's not listed when I run "net users" either which is odd as normally it would list all local users. When I create a file on the desktop and check the path properties, it is correct as it's "c:\users\myusername\desktop"
Michael Taylor 60,331 Reputation points

2023-01-07T19:17:22.293+00:00

This account is in the Administrators group so they are an admin (BUILTIN\Administerators). Go to the user's account in the MMC and check their group memberships there.
GlenTech 496 Reputation points

2023-01-07T19:22:49.463+00:00

It's not showing my user, just BuiltInAdmin under users which I guess can be my account but how is that possible when my account type is set to a standard user?
GlenTech 496 Reputation points

2023-01-07T19:35:23.793+00:00

I think it's because my 365 account for that tenant is a global admin. I checked another user's cloud pc and it does in fact prompt for admin creds when it should. Very odd that it doesn't mention that anywhere. Standard user means standard user lol.
Michael Taylor 60,331 Reputation points

2023-01-08T02:43:34.757+00:00

The account type indicator just means whether the user is added to the Administrators group or not. If you select Standard User then they aren't added to that group. However if the user is a member of a group that is itself a member of the Administrators group then the account UI won't tell you that.

Share via

Account type is standard user but it allows me to install software

2 answers

Your answer