install application with admin rights fails until 1 week

Question

Hello to you,

I explain to you.

Previously, to install an application or rename a pc for example, from the user's account, we launched the installation and it asked us for the admin passwords.

Same for renaming a pc, we had the button rename the pc which appeared then when renaming it asked us for admin passwords. Since last week, to install applications, nothing happens, either it puts an error, or it tells me that I don't have administrator rights.

If I put open as administrator, it tells me the same thing. The rename this pc button is greyed out, "only admins can rename this pc".

Last week I made changes on the delegation of control on the user and pc side and of course as an idiot I didn't notice anything :(

In the delegation of control there was the famous infotech account which had full control over this object and all these ascendants on the post and user OU I deleted it, I just put it back this morning and it's still the same .

Do you think it was due to the delegation of control?

On the GPO side, there is a gpo that creates a restricted group bultin\administrators and in it there is this famous infotech account. I attach the screenshot.

It was very convenient to be able to do this instead of logging into an admin session and installing the software. Thank you for your answers

Answer 1

Hello,

Thank you for your question and for reaching out with your question today.

It seems like you are facing issues with installing applications and performing administrative tasks from a user account that previously had elevated privileges. The changes you made to delegation of control and group policies might indeed be the cause of the problem. Here's a step-by-step approach to troubleshoot and resolve the issue:

**1. Review Delegation of Control Changes:**
   - Since you made changes to the delegation of control, carefully review the changes you made and make sure you didn't inadvertently remove necessary permissions.

**2. Verify Group Policy Settings:**
   - Open the Group Policy Management Console (GPMC).
   - Navigate to the GPO that is responsible for creating the restricted group (the one that includes the infotech account).
   - Confirm that the GPO is applying correctly to the relevant OU containing the computers.
   - Double-check the settings within the restricted group policy to ensure that the infotech account is correctly specified.

**3. Check Group Membership:**
   - Confirm that the user account you're using is still a member of the appropriate groups, like the local "Administrators" group on the computers.
   - Check whether the user account is still part of any group that grants administrative privileges.

**4. Group Policy Update:**
   - Sometimes, a simple group policy update might resolve issues. You can trigger a group policy update on the client machine by running the command: `gpupdate /force`.

**5. Verify User Account Control (UAC) Settings:**
   - Check the User Account Control settings on the affected computers. Make sure UAC is not set to the highest level, as it might prevent normal elevation prompts.

**6. Test with Another Account:**
   - Test the installation and administrative tasks with another account that has administrative privileges. This will help identify if the issue is specific to the account or a system-wide problem.

**7. Check for Event Logs:**
   - Review the Event Viewer logs on both the client machines and the domain controllers. Look for any errors or warnings related to group policy, security, or application installation.

**8. Verify Domain Trust:**
   - Ensure that the client machine has proper connectivity to the domain controllers and there are no trust relationship issues.

**9. Local Security Policies:**
   - In some cases, local security policies might affect administrative tasks. Review the local security policies on the client machine.

**10. Rollback Changes:**
   - If you suspect that the recent changes caused the issue, consider rolling back those changes (if possible) and see if the previous functionality is restored.

**11. Consider GPO Changes:**
   - If the issue persists, you might need to revisit the group policy settings, especially those related to restricted groups, and ensure that they are correctly configured.

Remember that making changes to group policies and security settings can have far-reaching effects, so it's important to approach troubleshooting with caution. 

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

If the reply was helpful, please don’t forget to upvote or accept as answer.

Best regards.