Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 5744
  • Last Modified:

Running Control Panel as admin in Windows 7

I have applied a User GPO to disable the Programs and Features in Windows 7.  I am trying to give our Help Desk the ability to then do a runas to open up Control Panel to uninstall programs.  

I have tried several things found here and other sites, but it still tells me that the "Systems Administrator has disabled this...".  Here is an example of what I am running.

runas /u:domain\adminaccount cmd.exe
runas /u:domain\adminaccount "control appwiz.cpl"
runas /u:domain\adminaccount "explorer.exe /seperate"

They all prompt me for the password, and all open up the tool.  However, it still gives me the disabled message.

When I log on as the admin account I have full access to the Programs and Features.

Any ideas?

Thanks in advance!
0
SysAdmin BBS
Asked:
SysAdmin BBS
  • 8
  • 3
  • 3
  • +1
3 Solutions
 
Run5kCommented:
One potential option would be to configure Local Group Policies so that they only apply to specific users or groups, such as non-administrators:

Local Group Policies - Apply to All Users Except Administrators

Step-by-Step Guide to Managing Multiple Local Group Policy Objects

Explore the benefits of the Multiple Local Group Policy feature in Windows 7
0
 
SysAdmin BBSAuthor Commented:
I applied the group policy to only one user, logged on as that user, but still cannot load Programs and Features using a runas with an admin account.

Thanks for the suggestion though.
0
 
Run5kCommented:
My apologies, since I probably didn't communicate that effectively.  What I was actually suggesting is that you utilize the Multiple Group Policies method to apply the Group Policy that hides Programs and Features specifically to the non-administrators group.  In that manner, your help desk staff (who are administrators) would still have access to Programs and Features by default.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
johnb6767Commented:
What about doing a "Run as a different user" via the Rt Click on C:\Windows\System32\cmd.exe, and THEN executing "control appwiz.cpl"?

Should work fine.....
0
 
SysAdmin BBSAuthor Commented:
Yes, I modified those links to apply to our Domain Group Policy environment, however, doing a runas as an admin account still does not give us the ability to see Programs.  It was always working correctly for our admin accounts when they log on.  Just not runas.  

Runas an admin account ALWAYS worked in XP...I'm not sure I understand the reasoning for Microsoft changing the way this works.
0
 
SysAdmin BBSAuthor Commented:
Good idea John - but I get the same message "system administrator has disabled Programs and Features".  I'm wondering if there is a different GPO setting that I could use.

Here is the current GPO:

User Configuration
Administrative Templates
Control Panel/Programs
Hide "Get Programs" page Enabled  
Hide "Programs and Features" page Enabled  
Hide "Windows Features" Enabled  
Hide "Windows Marketplace" Enabled
0
 
Run5kCommented:
That's a shame... I thought that John's suggestion would do the trick.

If you don't mind me asking, is it really even necessary to hide/disable the Programs and Features interface in that manner?  If you leave it visible, your non-administrators still won't have the privileges to accidentally remove an application.  At the same time, while a standard user is logged in your Help Desk staff could open the Programs and Features interface, click on the Uninstall button and they will then be queried for their admin credentials, allowing them to successfully remove an application.
0
 
johnb6767Commented:
Yea, me too...   :-(

Just to clarify.... You are using "Run As Administrator", or SHIFT+RT CLICK (if needed to have the option visible)>"Run as different user"?
0
 
johnb6767Commented:
Actually, lets verify....

in the CMD windows you open using the method above, type 'set u' Is the "USERNAME" value the one you used the alternate credentials for?
0
 
SysAdmin BBSAuthor Commented:
For the cmd.exe I am selecting Run as a Different User.  But I also still do not have access by doing Run as Administrator (as expected).

Sadly the users need to be Power Users for certain other applications in our environment.  
0
 
SysAdmin BBSAuthor Commented:
John - yes, by using set u it does confirm that it is using my administrator account credentials.

Thanks!
0
 
LeeTutorretiredCommented:
I've requested that this question be deleted for the following reason:

This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0
 
SysAdmin BBSAuthor Commented:
I created a Microsoft ticket for this and got an explaination.  To summarize, this is intended in Windows 7 as many applications in the Control Panel are tied to the logon account and cannot be opened as a different user.

A workaround they provided is to open up Internet Explorer with a runas and then open Control Panel from there.

Thanks everyone for your help.
0
 
SysAdmin BBSAuthor Commented:
I would like to award point and post this to the knowledge base as I have finally got a response from Microsoft.
0
 
SysAdmin BBSAuthor Commented:
I found the answer by contacting Microsoft.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 8
  • 3
  • 3
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now