Vista UAC on a domain..

[dawks]

I have a user running Windows Vista Business on a laptop, which is joined to our domain. Whenever the user tries to install something, they are asked for a domain admin username and password. I want the user to be able to install things, but I don't want them using a domain admin account. Is there a way I can let them install it items with say the local admin account? If I add that user to the local admin group, would that work?

Is this something I need to set in group policy? If so, where can I find Vista GPOs for Server 2003 R2?

 

[Smilin]

Where are you seeing them prompted for a domain admin rather than a local admin? I'm not sure I've seen this.

 

[Robor]

Yep, you can put their username into the local administrators account and that will allow them to install software.

 

[dawks]

Originally posted by: Robor
Yep, you can put their username into the local administrators account and that will allow them to install software.

Thanks, I will try that.

Originally posted by: Smilin
Where are you seeing them prompted for a domain admin rather than a local admin? I'm not sure I've seen this.

When the popup asks for permissions to install something, it wants an admin account, and will only accept a domain account. It wont let me switch to the local computer account.

 

[Robor]

Originally posted by: dawks
When the popup asks for permissions to install something, it wants an admin account, and will only accept a domain account. It wont let me switch to the local computer account.

When prompted for credentials can you hit escape and change the 'locations' field? I am not running Vista and I can't remember the specific term but I think it's 'locations'.

 

[dawks]

Originally posted by: Robor

Originally posted by: dawks
When the popup asks for permissions to install something, it wants an admin account, and will only accept a domain account. It wont let me switch to the local computer account.

When prompted for credentials can you hit escape and change the 'locations' field? I am not running Vista and I can't remember the specific term but I think it's 'locations'.

When I hit escape it only closes the UAC dialog box. There is no way to change the domain/computer option. I added the user to the administrator group on the computer but it still asked for domain admin credentials when the user tries to access/perform UAC protected items.

Does this need to be changed via group policy? If so, where do I find the ADM or GPO items for Vista?

The user needs access to install items regularly and they can't have a domain admin account, but a local computer admin account is fine.

 

[stash]

You should see a prompt like this: http://msdn2.microsoft.com/en-...ation(en-us,VS.85).jpg

Notice the use other account option. Click on that and enter the username, using domainname\username format.

 

[dawks]

Originally posted by: stash
You should see a prompt like this: http://msdn2.microsoft.com/en-...ation(en-us,VS.85).jpg

Notice the use other account option. Click on that and enter the username, using domainname\username format.

Negative. That lower option does not exist. It simply says our domain name in small text (not clickable) and the Submit or Cancel buttons.

Thanks

 

[stash]

Can you run RSoP or gpresult against one of these clients and see what the "User Account Control: Behavior of the elevation prompt for standard users" setting is? It's located under computer configuration, windows settings, security settings, local policies, security options.