User installed software bypassing UAC

Question

Hi all,
I noted today a very strange event on a company laptop.

This laptop is joined to Active Directory domain and the user has got User level privileges at domain level.
I have NOT "forced" permission user level on laptop from Control Panel.

He downloaded a software and he installed it without asking me nothing (I am system administrator of the company).
He said me that pressed "NO Button" when UAC Administrator Account appeared and he could install software without issue.

I noted that software that the user dowloaded does not have "UAC shield" on the installer executable.

Is it normal that user can bypass UAC?

I hope to be clear.

Best regards

Federico

Answer 1

Flux is a portable app, it does not install into the program files but instead stays inside the user's profile. This means that there is technically, no installation and as such means that people can open and run this application without administrator approval.

You can restrict this with AppLocker whitelisting to prevent apps that you do not authorise.

Answer 2

Hi,
Thanks for sharing here!
Would you please tell what privileges did the user have at domain level?
Is it for the specific user or all the users?
How was the UAC configured at the domain level group policy or the local group policy.
I would suggest you run a gpresult /h report.html and check the result.

Best Regards,

Answer 3

Dear @Fan Fan

User is a Domain User at Domain Level.
It is the same level for all users.

UAC is enabled, I recently disable Secure Desktop.

Thanks

Answer 4

Hi @Fan Fan ,

I noted that software installed by user has not have UAC Shield near icon.

Tomorrow I will share you "gpresult /h report.html" output.

Ps Picture is generated by my laptop.

Answer 5

Hi @Fan Fan

This is GPO output:

gpresult /h report.html showed just user policy.