Administrative Account without GUI login

Question

Hi,

for security reasons I want to setup a Domain user which is not allowed to logon on a client computer but it should be allowed to open e.g. an administrative cmd on such a client.

If I add this user in the local admin group and set "deny logon locally" I am not able to log on - fine, but also the start of an administrative cmd is prohibited.

How can I only just deny the logon via GUI ?

Regards Wolfgang

Answer 1

Hello there,

To achieve this setup, where a domain user is not allowed to log in to a client computer but can still open an administrative command prompt, you can follow these steps:

Create a Restricted Group:

In Active Directory, create a security group specifically for users who need administrative access without interactive logon. Let's call this group "AdminCMDUsers."

Group Policy Object (GPO) Configuration:

Configure a Group Policy Object to enforce the desired restrictions. Here's what you can do:

a. Deny Interactive Logon:

In the GPO, go to "Computer Configuration" > "Policies" > "Windows Settings" > "Security Settings" > "Local Policies" > "User Rights Assignment."

Add the "AdminCMDUsers" group to the "Deny log on locally" policy. This will prevent members of this group from logging in interactively to client computers.

b. Allow Remote Desktop Services:

If you want members of the "AdminCMDUsers" group to be able to remotely access a client computer using Remote Desktop Services, add the group to the "Allow log on through Remote Desktop Services" policy.

Elevated Command Prompt Access:

To allow members of the "AdminCMDUsers" group to open an administrative command prompt, you can use a few methods:

a. RunAs Command:

Users can run the runas command to open an administrative command prompt. They'll need to provide valid administrator credentials when prompted.

b. Shortcut with RunAs:

Create a shortcut on the desktop that uses the runas command to launch the administrative command prompt. Users can right-click the shortcut and choose "Run as different user" to provide administrator credentials.

c. Batch Script:

Create a batch script that uses the runas command to open an administrative command prompt. Users can run the script to open the command prompt.

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--