Solved

Restricting Domain Admin Accounts

Posted on 2014-04-03
4
46 Views
Last Modified: 2016-05-31
Hi,

We have IT and dev folks who currently are local administrators of their own systems.  We are looking to lock this down with standard user accounts as their main account and have a secondary admin account to use for administrative work.  

With that said, we would like for people to use this secondary admin account to do "run as" etc, but want to make sure to prevent users from trying to log onto machines locally with this admin account to use as their main account.

Can this be done?

Thanks.
0
Comment
Question by:mesadmin
  • 2
4 Comments
 
LVL 53

Accepted Solution

by:
McKnife earned 500 total points
ID: 39975799
No.
Running a program with different credentials interactively would have to be allowed - but that implies to have the privilege to logon locally, sorry.
Look at 3rd party software (privilege manager) or simply enforce and trust UAC
0
 
LVL 142

Expert Comment

by:Guy Hengel [angelIII / a3]
ID: 41626227
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
0
 
LVL 53

Assisted Solution

by:McKnife
McKnife earned 500 total points
ID: 41626228
I object.
Surely my comment has covered the facts and concluded: it's not possible, at least not if we assume the users want to abuse it.

If we however assume that users are nice and not technically savvy, yes, then there's even a way to prevent local logons: https://www.experts-exchange.com/articles/24599/Free-yourself-of-your-administrative-account.html holds it at the end: we can trigger account deactivation when users try to switch to the logon screen by using scheduled tasks as outlined.
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
No security measures warrant 100% as a "silver bullet". The truth is we also cannot assume anything but a defensive and vigilance posture. Adopt no trust by default and reveal in assumption. Only assume anonymity or invisibility in the reverse. Safe…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now