Local Security Policy

  • Thread starter Thread starter Alan
  • Start date Start date
A

Alan

Local Security Policy: Does anyone know what the first option, "Accounts:
Administrator account status" does? Seems to have no effect on
standalone/workgroup connected computer. Is it strictly a domain related
thing?

Also I noticed if you disable UAC approval/prompting in the User Account
Control: policies, you can get rid of all those approval/elevation prompts,
let standard users install apps and such. But you also might be prevented
from installing an app, even from an admin account, due to lack or
rights/privileges. For example to install the CA AV program I had to go into
Safe Mode with Networking and install from the Administrator account. Is
that the way it's expected to work in the final product?
 
Alan said:
Local Security Policy: Does anyone know what the first option, "Accounts:
Administrator account status" does? Seems to have no effect on
standalone/workgroup connected computer. Is it strictly a domain related
thing?
Click to expand...

No idea.
Also I noticed if you disable UAC approval/prompting in the User Account
Control: policies, you can get rid of all those approval/elevation prompts,
let standard users install apps and such. But you also might be prevented
from installing an app, even from an admin account, due to lack or
rights/privileges.
Click to expand...

If you've changed the two "Behavior of the elevation prompt..."
policies in Local Security Policy, what you've done is change the
behavior of what UAC will do once a condition that requires elevation
is detected. (Which is not the same as "disable UAC" or "don't bother
preventing access".)

If you've changed more than just the two "Behavior..." policies (e.g.
if you also turned off "Detect application installations and prompt
for elevation"), then you're in a state where UAC is still enabled,
but is not trying to elevate application installs that require
elevation.

What exactly you've changed, and whether the particular application
install you've cited works correctly even with Vista and UAC in their
default enabled / prompting states, would impact whether what you're
currently seeing could be deemed "expected".

Alan Adams
 
It enables or disables the local 'administrator' account. My system is not a
domain member so it appears that it is functioning as yours. I can change
the setting and watch the administor account get disabled or enabled... On
my current build (5384) it works as expected. No dependency on domain
membership etc.

Alan seems to have covered the other one.

Kevin
 
Back
Top