GPO to let standard user run applications that need elevated privileges

Question

GPO to let standard user run applications that need elevated privileges

Scorpion 10

We have some apps that needs to be used on our LAN, on the clients PCs. But some of those apps needs "elevated privileges" to run, that means, the user must belong to the administrators group. That would be a hole for our workstation security, so, how can solve this?. Is there any GPo that can help the users to run some apps with "administrator privileges"?, without knowing the admin password, of course.

Please, help

Fabricio Godoy 2,626 Reputation points

2023-03-07T11:45:53.75+00:00

Hello. do you have any comments?, please, don't forget to upvote and accept the answer if this help you.
Mouhcine Ouaziz 0 Reputation points

2024-03-01T15:33:12.2533333+00:00

hi,

how can i allow a juste one specifique application ?

thank you

1 answer

Your answer

Fabricio Godoy 2,626 Reputation points

2023-03-07T11:45:53.75+00:00

Hello. do you have any comments?, please, don't forget to upvote and accept the answer if this help you.
Mouhcine Ouaziz 0 Reputation points

2024-03-01T15:33:12.2533333+00:00

hi,

how can i allow a juste one specifique application ?

thank you

Answer 1

Fabricio Godoy 2,626

Hello.

Yes is possible....create a GPO with this 2 settings.

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options.
User Account Control: Run all administrators in Admin Approval Mode
Enabled
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options.
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
Elevate without prompting

These settings will allow non-administrative users to run certain applications with elevated privileges

I hope this helps

Regards

Stephen Redding 0 Reputation points

2023-05-15T18:48:00.1833333+00:00

Hello - couple questions about this solution..

This will work for a user not in the built-in administrators group on the machine?

This works on a per account basis , so example: I apply the GPO to a security group with the users I want to do this with and that is enough to make this work?

How is this different than just putting the user in local admin group?

Thanks!
Uways Khan 0 Reputation points

2023-06-15T13:20:30.1866667+00:00

No completely mislead this doesn't work for standard users
Darren B 0 Reputation points

2024-05-15T08:25:29.38+00:00

This does not work for standard users
Todd VTDIT 0 Reputation points

2024-12-31T22:05:37.7266667+00:00

This answer is incorrect.

The GPOs described allow users who are members of the Administrators group to run applications "As Administrator", but they do not allow non-administrative users to run any application with administrative privileges.

Share via

GPO to let standard user run applications that need elevated privileges

1 answer

Your answer