Disable run as command

  • Thread starter Thread starter Nick Fletcher
  • Start date Start date
N

Nick Fletcher

Hi all
Does any one know if there is the facility to disable the Run as command via
GPO please?
We have had to make our users local admins on the PCs so we would like to
remove this function.
Thanks
Nick
 
Nick-
I'm not sure what making your users local admins has to do with granting or
denying access to runas. Runas is usually used to grant some temporary
elevated privilege and since they are already local admin--they have all the
privilege they need. And being local admin doesn't give them any ability to
get to domain-based resources that they would otherwise.

But, in any case, you can use GPO-based Services security policy to disable
the "Secondary Logon" service on those workstations, which will disable the
ability to use runas--but of course if they are local admins they can always
go in and re-enable the service anyway, so I'm not sure how much it buys
you.

Hope that helps anyway.
 
Back
Top