Network Configuration Operators group and UAC

Question

Hoping someone can help me.
Windows 10 environment
I have recently removed local admin from a group of individuals. Users were still able to for example open Task Manager without being a local admin on their workstation.

It was than decided to open the network settings up to all users. Adding the user group to the built in Network Configuration Operators group through Group Policy. The group was deployed fine to all workstations. However now, UAC is popping up for all kinds of activities such as trying to open the Task Manager.

Removing the Group from the Network Configuration Operators built in group lets task manager open again without a UAC prompt.

I have done some digging but im not getting anywhere as to why the Network Configuration group would cause UAC prompts to start appearing for these without being part of the local admin group.

Answer 1

Hi, folks.

I bumped into the same thing. After granting non-admin laptop users rights co configure LAN settings (via BUILTIN\Network Configuration Operators group membership) they started having an UAC prompt to access ANY part of the system, like Computer Management, Event Viewer, Device Manager and so on, which they DID NOT HAVE BEFORE.

@Limitless Technology

Good point, that regular users do not have enough authority to change LAN settings, but this is what we use GPO/Restricted groups/BUILTIN\Network Configuration Operators mechanism for, to provide them with the missing rights. And after they are all set, they CAN configure LAN settings, but to do this, users have to input their credentials in UAC prompt.

It's a nightmare to input username/password twice just to disable/enable a NIC!

As @IT_kid motioned, unlinking the GPO from OU removes UAC prompt, as well, as the rights to manage LAN settings on laptops for non-admin users :-(

If one can suggest appropriate settings for User Account Control Group Policy in GPO, we'd be very thankful. And also, I DO NOT WHANT TO TURN UAC OFF! I just do not want to bother inputting user credentials every time they try access parts of OS, where they have limited rights.

Is it possible to have no UAC prompt for non-admin users to access Windows controls while maintaining their limited rights, and having UAC on for the rest of it's functionality?

Regards

Answer 2

Hello ITkid,

For such a granular option the best practice is, instead of assigning Built-in groups to create a new GPO to disable / enable specific environment accesses, and link it with the group of the specific restricted users. In case you are not working in a Domain, this can be applied directly to local policies.

Disable Task Manager:
User Configuration > Administrative Templates > System > Ctrl + Alt + Del Options

Remove Task Manager: Enabled

Regarding the UAC issue with the Network Configuration Operators for standard users, This symptom is by default since it need the administrator privilege when trying to access the network connection’s Properties. If a standard user would like to access the properties, there will be a UAC window and indicate to enter the administrator credentials. This is normal.

In regards to allow access to Network Connections you can use the next policy as well:

"User Configuration\Administrative Templates\Network\Network Connections"

There enable or disable which options are available for the users

and

"User Configuration > Administrative Templates > Control Panel"

"show only specified control panel items" select the ones needed

Hope this helps your setting, dont forget to vote or Mark As Answer if it resolved your question.

Best regards,

Luis P

Answer 3

Hello.

This problem or may be a bug is still there in Windows 11. Anyone have found soultion? Thanks for suggestions.
Filip