UAC in domain requires username and password each time

XweAponX · 29 Jan 2010

"you may need to add yourself as an Admin to the local PC."

-Just like when you are using Windows 2000 in a network, you have do manually add the username and passwords of each user who will be connecting to the Win2000 machine under "Local Users and Groups".

"authentication is delegated to the Domain since thats what you logged onto"

So, can't you assign that information into the machine that controls the Domain, or is it untouchable? You ought to ask your Administrator if they can set that up for you.

merk · 29 Jan 2010

I dont have admin access on the domain level although I can ask the admin. I just dont know what i should be asking him. What specifically would have to do to enable me to get a yes/no uac prompt?

thanks

Tepid · 29 Jan 2010

I did forget to mention that you must have admin rights to add yourself as an admin to the local PC. You will ahve Domain User rights on the domain, but admin rights on the single local PC you add yourself as admin to.

Ok,, so i read that you added yourself to the admin group of the local PC.

I guess I am just not familiar enough with UAC in a domain environment.
If, you were able to add yourself to the local admin group of the PC, then you have admin rights somewhere already. You should not have been able to do that without admin credentials, otherwise, so maybe something isn't setup right, or you have more power than you think and UAC acts different in a Domain environment.

I am thinking now, that UAC in a Domain must prompt for credentials.

After some research,, I do believe it is working as it should and can not be changed.
In a Domain Environment, UAC will always prompt for credentials, the only work around is to disable UAC, which is not recommended.

merk · 29 Jan 2010

i have two accounts - one local account, which has admin rights, and then my domain account. I logged on with the local account and added the domain account to the local admin group, which is how the domain account now has local admin rights.

But if this is how UAC is supposed to behave in a domain, i guess i'll stick with it for now. Seems pretty annoying though to have to constantly type in my user info. Hopefully once i finish setting up the machine it wont be much of a bother.

thanks for looking into it

Tepid · 29 Jan 2010

Well,, this is similar to Linux.
This is security measure that a lot , I mean a lot of people complained was missing from Windows.
however, it has always been there,,,, but your were admin out of the box since day one and no one was taught to use a standard user account (as it should have always been) and use Run As to elevate privileges.

UAC is a (crude {for lack of better word]) work around, to make it a bit easier on most people.

In other words, People need to get used to it if they want real protection from viruses,, and in all honesty, UAC should be Disabled and you should run as a true standard user and elevate with admin as needed. Like you should do in XP. People would see a lot few infections.

In other words,,,, none of your accounts should have admin rights to the local PC.
And you should have a separate admin account to elevate privileges.

And that admin account,, should not be called Admin, in any way, shape, or form and the built in admin should be disabled. This is the real way a user PC should be setup. But no one does it cause as you said it is a pain and too much hassle, till they get infected.

I'm not trying to lecture you or flame you in any way,, just stating some facts for everyone.

merk · 29 Jan 2010

No worries about the lecture. I actually knew all that. But like many people i'm just too lazy to bother doing that. i feel safe enough running an AV program and not doing anything obviously stupid.

On a strange note, today i've gotten the UAC prompt and it's back to a yes/no prompt. I guess maybe there was some windows update or something that I've since installed that resolved it? Or maybe i had an update that needed a reboot that was causing it? I certainly haven't made any system changes.

Tepid · 29 Jan 2010

Or did you reboot after adding yourself to local admin?
Because I forgot to mention that step.. have to logoff and back on for the admin previledges to take full effect.

merk · 29 Jan 2010

That is very possible. I know i didn't reboot specifically because i made myself admin. I would have only rebooted if there was an update that required it. I wasn't aware you needed to log off and on for it to take full effect. That was probably it. See what happens when you assume i know something? :)

thanks again

Tepid · 29 Jan 2010

Well,, if/when you get a chance,,, can you do an experiment and remove yourself from Admin and reboot,, then see if the prompt returns then put back and reboot,,, see if this really is making this change?

It would be interesting to know and much appreciated.

merk · 29 Jan 2010

reboot wasnt needed - just logging on and off reproduces the behavior.

removed my domain account from the local admin group. I could still elevate privledges without any issues. Logged off and back on. I could no longer elevate. Got a user/pass prompt and it wouldn't accept my domain credentials. I had to use the local credentials. I then added my domain account back in. At this point it still prompted for a user/pass, but it would accept my domain credentials. Logged off and back on and UAC was back to a yes/no prompt.

I guess windows is doing the web equivalent of setting a cookie when i log in saying i have admin rights.