Hello community, Is it possible to set up an admin account to be used only to elevate access? For example, have 2 accounts, "TestAdmin" in the Administrators group and "TestUser" in the Users group. Disable log on for the "TestAdmin" account and only use it to elevate access (installing apps, change network configurations, etc...). I've done the following so far: Create the necessary accounts for the test and include them in the correct group. Add the "TestAdmin" account in Local Security Policy > Local Policies > User Rights Assignment > Deny log on locally and Deny log on through Remote Desktop Services. Add the "TestAdmin" account in Local Security Policy > Local Policies > User Rights Assignment > Act as part of the operating system and Increase scheduling priority policies. This has resulted in, TestAdmin cannot log on to the machine but, elevating access through the TestUser account fails with the following message: "Logon failure: the user has not been granted the requested logon type at this computer." Thank you.

Elevate admin rights

Carlos Yanez Baez 0

Hello community,

Is it possible to set up an admin account to be used only to elevate access?

For example, have 2 accounts, "TestAdmin" in the Administrators group and "TestUser" in the Users group. Disable log on for the "TestAdmin" account and only use it to elevate access (installing apps, change network configurations, etc...).

I've done the following so far:

Create the necessary accounts for the test and include them in the correct group.
Add the "TestAdmin" account in Local Security Policy > Local Policies > User Rights Assignment > Deny log on locally and Deny log on through Remote Desktop Services.
Add the "TestAdmin" account in Local Security Policy > Local Policies > User Rights Assignment > Act as part of the operating system and Increase scheduling priority policies.

This has resulted in, TestAdmin cannot log on to the machine but, elevating access through the TestUser account fails with the following message:

"Logon failure: the user has not been granted the requested logon type at this computer."

Thank you.

Daisy Zhou 20,876 Reputation points Microsoft Vendor

2024-07-12T11:56:19.97+00:00

Hello Carlos Yanez Baez,

Thank you for posting in Q&A forum.

Did you add the "TestUser" account in Local Security Policy > Local Policies > User Rights Assignment > Allow log on locally and Allow log on through Remote Desktop Services? You can try to add and check if it helps.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Carlos Yanez Baez 0 Reputation points

2024-07-12T12:06:28.6833333+00:00

Hi Daisy,

Thank you for your suggestion. I have added the "TestAdmin" account to both Allow log on locally and Allow log on through Remote Desktop Services policies, but I still get the same message trying to elevate access (in this instance, I'm trying to install an application).

Any further tips will be highly appreciated.
RLWA32 42,796 Reputation points

2024-07-13T17:21:46.7366667+00:00

To be clear, when a limited user account that is not a member of the administrators group attempts UAC elevation the system will present a credential prompt which requires the credentials of an administrator account. Ordinarily, if administrator credentials are provided elevation will occur and the elevated process runs under the administrator account and not under the limited user account. Denying the administrator account the right to log on is what is causing the elevation attempt to fail. With respect to user rights assignment, denying a right takes precedence over allowing it.

Share via

Elevate admin rights