UAC bypass in domain environment

I manage about 1,200 computers at a school. What I would like to do is during the break between terms (usually a week or two) is to run a bunch of update scripts that install the latest java, adobe reader, etc... at login. I have all of my student
computers automatically log onto the network at boot up and they have administrative rights. I use deepfreeze to prevent unauthorized changes and of course have it turned off when the updates are trying to install. The problem I have is that when
the Windows 7 machines run the login scripts UAC pops up. I have to hurry and get a classroom at a time before the 5 minute UAC timeout occurs and cancels the install.
Is there a way I can tell the script to run executables without the UAC rearing it's ugly head. If I have to use an administrator username and password it cannot be in clear text.

Hi,
How’s
everything going? Please feel free to give me any update.
Regards,
Vincent Wang
TechNet Community Support

Similar Messages

We have created shared folder on multiple client machine in domain environment on different 2 OS like-XP,Vista, etc. from some day's When we facing problem when we are access from host name that shared folder is accessible but same time same computer when

Hello All,
we have created shared folder on multiple client machine in domain environment on different 2 OS like-XP,Vista, etc.
from some day's When we facing problem when we are access from host name that shared folder is accessible but same time same computer when we are trying to access the share folder with IP it asking for credentials i have type again and again
correct credential but unable to access that. If i re-share the folder then we are access it but when we are restarted the system then same problem is occurring.
I have checked IP,DNS,Gateway and more each & everything is well.
Pls suggest us.
Pankaj Kumar

Hi,
According to your description, my understanding is that the same shared folder can be accessed by name, but can’t be accessed be IP address and asks for credentials.
Please try to enable the option below on the device which has shared folder:
Besides, check the Advanced Shring settings of shared folder and confrim that if there is any limitation settings.
Best Regards,
Eve Wang
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Is Lightroom supported in a Active Directory domain environment with multiple users logging into a machine?

We are a school district using an Active Directory environment. We currently use other Adobe products with multiple users on different machines and it works fine. If Lightroom does work in a domain environment what are the required local user permissions needed for it tor work properly? Thanks!

Lightroom is not a multiuser program. It is required that the catalog is located on a hard drive that is local to the machine accessing it. There are no workarounds.

Implementing Sites for a new Single Domain Environment and effects on Exchange

Copied from the Active Directory forums as the suggestion of replies.
I didn't find exactly what I was looking for so decided to create my own question to get some direct feedback.
Currently we have a single domain environment with two domain controllers located at two separate sites. When the domain was first set up, no configuration was done in the Sites and Services module for Active Directory. The two domain controllers we have are
currently located in the Default-First-Site-Name container. We do not have any subnets configured with the Sites and Services module.
These two domain controllers are located at two different sites with different IP schemes and the sites are connected with a high speed site-to-site VPN. We also have 2 satellite offices with their own IP schemes as well with more offices to come. In the future
domain controllers will be placed at these satellite offices which are connected with a slower site-to-site VPN to the main offices.
All replication and network functions are working well now, but I would like to know what the effects would be and what to watch out for if I create sites for our environment. I am particularly concerned about our Exchange 2010 server and need to make sure
that the change will not disrupt communications between it and the domain controllers.
I would like to create a site for each of our locations and link the subnet to that site now so that when we install the domain controllers the configuration is ready.
Any suggestions or input is highly appreciated thank you in advance.

Exchange will be an issue only if your Exchange servers span sites when your new Windows sites are created. If you have Exchange servers all in a single location, adding sites to your Windows forest will cause no issues. However, if you have
Exchange servers in both locations, as soon as a new site is defined for an Exchange server in a separate location from your other Exchange servers, you will start having issues. Let me give some examples so you can see what problems might occur:
Two datacenters, one Windows site, Exchange mailbox servers in both locations (primary and DR), but hub and CAS roles only in the primary datacenter:
In this situation, as soon as your second site is defined, the server in the DR datacenter will no longer be receiving mail - there is no hub to deliver it - and users will no longer be able to access their mailboxes - there is no CAS to support them.
Solution: Add hub and CAS to second datacenter and all is well with the world.
Two datacenters, one Windows site, Exchange multirole servers in both locations (primary and DR), but CAS Array defined:
Now we have a little bit better setup, since we have all roles in both locations. However, the CAS array in the primary site isn't going to be able to support your client connections in the DR site - so users will be connecting directly to the CAS
servers in the DR site (not optimum). Solution: Define a second CAS array for the DR site, with its own load balancer and configure the databases in your DR location to use that CAS array as the RPC Client Access Server.
There are other oddities, but as you can see, there will definitely be issues if your Exchange servers aren't all in the same location and you start defining Windows sites ...

In domain environment standard users can't open .psd files

in domain environment with non admin users; getting this error: http://imageshack.com/a/img543/9085/cdnu.png
only administrators can open .psd files
what permissions needs a standard user to open .psd files?

did fw work previously to open psd files? - no, only admin users can open psd files wiht fw or ps.
do you see that error with all psd files? - yes, all psd files give this error, no error given jpeg or png files
are those cs6 psd files? - yes.
what happens if you right click fw>click 'run as administrator'? - same error.
i have to give local administrator rights to users that they can work with psd files.

AD RMS for multi tenant domain environment

Hi,
I have successfully configure the AD RMS with lots of work around. now i want to use multi tenant domain environment. i have multiple domains running on my production env. Now can anyone help me out to configure the RMS Server to add multiple URLs for licensing
and certifications in AD RMS Server on windows Server 2012. i need a proper step by step configuration roles to activate on immediate basis.
Any help in this regards will be highly appreciated,
Attahcments screent shots might help you what i want ;)
Regards,
Imran Bashir
MCSA 2008, MCITP, MCTS, MCP
JNCIA ER,EX
Brocade Certified
Imran Bashir Network Administrator MCP, JNCIA-EX,ER,JNIOUS +92-333-4330176

Hi,
in a single forest you can have only one RMS SCP. You could create more RMS clusters but those are not discover-able that way, only over using RMS templates or overwriting the clients registry.
If you say multi-tenant I assume every tenant should have its own RMS key, correct? If you have only one RMS cluster the cluster admin will have control over all documents.
Hope that helps,
Lutz

Activating Windows 7 by using KMS Without the Active Directory Domain environment

Dear,
Can we able to activate the Windows 7 O/S Machines by using KMS without the Active Directory Domain environment,As our some of the Computers will not connect with AD domain, we need to setup the speprate KMS
server for this.
Thanks
Balaji K

You can point the KMS clients to the KMS host machine by opening an Elevated CMD prompt:
and running slmgr /skms to point directly to the KMS host.
You do not need a Domain controller.
Volume Licensing: Key Management Service (KMS) Client Options:
/skms <Name[:Port] | : port> [Activation ID] [Activation ID]
Set the name and/or the port for the KMS computer this machine will use. IPv6 address must be specified in
the format [hostname]:port /ckms [Activation ID]
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

Recommended DNS zone replication scope for single domain environment

Hi, in my company we have domain/forest functional level Windows Server 2008 R2 - there is only one domain. AD DS is installed on 5 servers -
AD integrated DNS zone is used.
I noticed today that on both forward lookup DNS zones, _msdcs.internaldomain.com
& internaldomain.com, zone replication scope was set to
All DNS servers in this domain and also for one reverse lookup zone. I changed this setting for all these zones to
All domain controllers in this domain but later (10-15 mins at most) I reverted these settings back to
All DNS servers in this domain.
Which zone replication scope for mentioned zones is recommended keeping in mind this is single domain environment? Also could I do any harm to DNS and AD in all when I changed zone replication scope and later reverting it back for these zones? How to check
that dns related informations (zones) are located where they should be in Active Directory and that there is no any garbage in other locations (partitions) in AD database.

Hi,
All DNS servers in this domain : Replicates zone data to all Windows Server 2003 and Windows Server 2008 domain controllers running the DNS Server service in the Active Directory domain. This option replicates zone data
to the DomainDNSZone partition. It is the default setting for DNS zone replication in Windows Server 2003 and Windows Server 2008.
http://technet.microsoft.com/en-us/library/cc772101.aspx
Hope this helps.
Regards.
If you have any feedback on our support, please click
here
Vivian Wang

Firewall problem in domain environment

I have built two domains for testing purposes. Having deployed domain controllers, exchange servers, sccm/scom servers, sql servers along with some client computers I noticed that I had problems accessing some of servers/clients - I could not manage
some of them directly with manage command from domain controller or access them via unc path. Some of them I could not ping neither. I was able to solve these problems by changing inbound firewall rules on these machines thus
allowing some connections such as smb-in, dcom-in . . . In my production environment (I have been working there as system engineer for almost seven years) I have never had these problems - any domain member, whether it has been server or client, was easily
accessible (managed from dc, unc, ping, . . .). I could deploy GPO with all necessary settings for inbound rules but it should be done automatically - as soon as machine is joined to the domain it must be accessible by using at least common protocols such as
dcom, smb for managing or simple file copy operation. I checked my production environment again and there were no GPOs for altering default firewall settings on domain member computers so I have no idea why this is happening in my testing domains.

No one but me has access to these machines. Also Symantec Endpoint Protection software is installed on these machines as it is the case with my production machines where everything is functioning flawlessly - as I mentioned I can access all my machines
in production domain via computer management, smb, ping . . . One of my test domains has FFL/DFL Windows Server 2008 R2, the same as my production domain, the other one has FFL/DFL Windows Server 2012 R2 and it is created for learning purposes. As I
said, in both test domains, all domain computers have SEP installed - the same version and configuration as on my production machines. I have not done anything related to firewall in my test domains on problematic machines - I installed OS on them, joined
to the domain, installed SEP and afterwards I have worked with specific product machine was created for - SCCM/SCOM, Exchange, SQL . . . servers and their clients.

UAC allowing standard domain user to elevate without providing credentials

I don't understand how this is occurring. We created a test user on our domain. Its only group membership is Domain Users. UAC is behaving quite different depending on which computer we test the account on.
When I login to my computer with the test user, UAC prompts me to provide an administrator username/password whenever I try to run something that requires elevated rights (for example: IE "Run as Administrator", compmgmt.msc via right-clicking
Computer and choosing "Manage", accessing another user's folder in c:\users)
When I login using the same test user to my colleague's computer (which was imaged and deployed at the same time), any of the above examples will elevate with a simple click of "Yes" or "Continue" to the UAC prompt. UAC does not prompt
for administrator credentials in this case and this standard Domain User account suddenly has local admin rights! How can this happen?

Hi,
Regarding the UAC issue mentioned, here are some suggestions:
. Change the UAC settings to a higher mode;
. Run gpupdate /force, then log off, then log on and check;
. Check to see if any
local UAC policies configured;
. Log on the Problematic computer with this test user and check the group membership;
. Create a new domain user and recheck this issue.
Best regards
Michael Shao
TechNet Community Support

Enable the UAC settings for Domain Controller / Member servers and for end user systems

Hi
We are working on hardening the security for all Domain Controllers / Member Servers and end users systems. As part of it we would like to know the best practice for UAC settings for each of these servers. There are 8 settings related to UAC and as of now
we configured just "User Account Control: Behavior of the elevation prompt for standard users" as disabled for the servers OU. Also not sure about other settings and how it affect the normal operations like installing Windows updates / applications
through SCCM or manually on servers or end user systems and other stuffs.
We are looking for experts opinion on this. Thanks in advance
LMS

Hi LMS,
Would you please let us know the current situation? Just check if Martin’s suggestion was helpful for you.
If any updates, please feel free to let us know.
Just additional. Please refer to the
User Account Control Grouping in the following article. It will provide some links about those different UAC settings. Please click those links and read related articles. In these articles, will provide
Security considerations that may help you to configure those settings.
Security Options
http://technet.microsoft.com/en-us/library/jj852268.aspx
Hope this helps.
Best regards,
Justin Gu

Localy configured security policy in domain environment

Hello.
I have run in to a problem when configuring security policy for servers in my domain. Due to the large size of my environment and many different local administrators on servers quite a few of those administrators has configured local security policys on
their servers instead of asking for our central IT-dep to create domain based GPO's for those settings.
It's quite often settings that give a account the right to logon as a batchjob and so on. This creates the problem for us that work centraly that we can't configure central GPO since we will overwrite the localy configured ones and that will quite often
create a application to stop working.
So my question is if there's any way to make a inventory to find out what servers has a local configured policy so that i can change that to a central one.
/Lee

You can use secedit to get the local security policy. You can use
psexec to get it remotely and store the content in a share. Once done, you can fetch the data using Powershell and get what you need.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

GPO & GPRESULT in Domain Environment

I have setup a 2008 R2 domain with no major GPO defined. When I execute the GPRESULT on the client machine, I don't see anything under "Applied Group Policy Objects" and also
The following GPOs were not applied because they were filtered out
Default Domain Policy
Filtering: Not Applied (Empty)
Is it a normal behavior?
Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001
Created On 2/8/2015 at 12:23:40 PM
RSOP data for CONTOSO\meuser on HIS0161 : Logging Mode
Gpresult.exe -> Output
OS Configuration: Member Server
OS Version: 6.1.7601
Site Name: N/A
Roaming Profile: N/A
Local Profile: C:\Users\meuser
Connected over a slow link?: No
USER SETTINGS
CN=meuser,CN=Users,DC=CONTOSO,DC=NET
Last time Group Policy was applied: 2/8/2015 at 12:22:55 PM
Group Policy was applied from: PDC-DC.CONTOSO.NET
Group Policy slow link threshold: 500 kbps
Domain Name: CONTOSO
Domain Type: Windows 2000
Applied Group Policy Objects
N/A
The following GPOs were not applied because they were filtered out
Default Domain Policy
Filtering: Not Applied (Empty)
Local Group Policy
Filtering: Not Applied (Empty)

> The following GPOs were not applied because they were filtered out
>
> -------------------------------------------------------------------
> Default Domain Policy
> Filtering: Not Applied (Empty)
>
> Is it a normal behavior?
Yes. In a "empty" domain, you have 2 GPOs: Default Domain Policy and
Default Domain Controllers Policy. Both only contain computer settings.
And when running gpresult from a non-elevated command prompt, you simply
do not get computer settings.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Users see all applications in RDS 2012 Web access in one-way trust domain environment

Hello!
We have RDS 2012 deployment in domainA.local. There is a one-way trust between domainA.local and domainB.local: A trusts B and B doesn't trust A.
A user from domainB.local authenticates in Web-access interface (wa.domainA.local) and sees
every published application in every collection in the deployment independently of UserGroups setting of collections and applications. This occurs for any domainB user.
In the security log of wa.domainA.local we can find an event :
An account failed to log on.
Subject:
Security ID:                IIS APPPOOL\RDWebAccess
Account Name:                RDWebAccess
Account Domain:                IIS APPPOOL
Logon ID:                0x2C7B16
Logon Type:                        3
Account For Which Logon Failed:
Security ID:                NULL SID
Account Name:
Account Domain:
Failure Information:
Failure Reason:                An error occurred during logon
Status:                        0xC000005E
Sub Status:                0x0
Also in network trace on wa.domainA.local kerberos error could be found:
On TGS-REQ for krbtgt/[email protected] there is an answer: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (7), server name krbtgt/domainB.
How to deal with this issue? The aim is to show only specified applications to domainB users.
Any help would be appreciated.

Hi,
Thank you for your posting in Windows Server Forum.
Please check below links might useful for your case.
“After adding the RDS server’s computer account to the Builtin Windows Authorization Access Group domain group, the RemoteApp icons displayed perfectly.” (Quoted from
this article)
1. Remote APP list empty
2. RD
Web Access unable to access Source (RD Server)
In respect to Kerberos Error, refer this link for troubleshooting.
1. Troubleshooting Kerberos Authentication problems – Name resolution issues
2. Kerberos Authentication problems – Service Principal Name (SPN) issues - Part 2
Hope it helps!
Thanks,
Dharmesh

Android, Ipad authentication under windows domain environment

I’m really confused about the best practice to set up these devices in a 802.1x and Windows Domain network using ISE.
I had seen the Ipad download the ISE certificate the very first time the device is connected to the SSID. In Android device (Galaxy phone) I don’t see the device download certificate.
Testing with the Android device I was able to install the root CA certificate (a not easy procedure), then when the SSID is configured in the device I have the option to choice the root CA certificate.
Now if I don’t include the certificate in the SSID configuration, the device is able to connect with an Identity and Password only. If I include the certificate in the SSID configuration, the device ask for the certificate storage password if the option for use secure credentials is not enabled before.
How can I validate through the ISE the android device is using the certificate? Is it possible to set a rule in the ISE denying access if the device does not validate the certificate? I think EAP necesarity use certificates, but the Android device does not show anything.
I had read about provisioning and profiling the Android devices. I think the Network Setup Assistant available through Google Play is an easy procedure to install the root CA certificate. Am I Right?
The customer said it appears the certificate is being used to encrypt the username and password not for do the authentication itself. Reading about EAP functionality I believe it is right, I understand the EAP-MSCHAP actually creates a tunnel to passthrough the username and password. Right?
As the Ipad and Android devices are not in the windows domain, what should be expected when the password is expired? Customer Policy indicates users must change domain passwords every four months. In a Windows PC users receive warnings some days before the expiration but it appears nothing happen in non-domain devices. A co-worker told me the easy way is that when this happen the user should remove the SSID in the device and create it again. The customer does not like this behavior, so what should be a best practice work around?
I hope you can help me to clarify my doubts.
Regards.
Daniel Escalante

Client Provisioning for Android you can refer thease guides:
http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/BYOD_Design_Guide/BYOD_ISE.html#wp1024291
http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113606-byod-flexconnect-dg-000.html#anc10

UAC bypass in domain environment

Similar Messages

Maybe you are looking for