UAC in domain requires username and password each time

Hi all,

Been using Win7 since beta. However, i just now installed it at work and this is the first time i'm using win7 joined to a domain. I assuming being joined to a domain is what's causing the problem. The problem being that each time the UAC prompt comes up, i dont just get a yes/no click, i have to enter in my username and password each time. And it's the same user/pass that i'm logged in with.

Is there any way to do away with the requirement of having to enter my user/pass each time? I dont mind so much just having to click yes or no, but constantly having to re-enter my login info is getting annoying.

I have not dealt with this, but,,, you may need to add yourself as an Admin to the local PC.

Since I have not done this in 7, maybe someone else can provide the way of doing it when joined to the domain.

However, are you a Domain User or Domain Admin?

Brink?

Tepid said:

I have not dealt with this, but,,, you may need to add yourself as an Admin to the local PC.

Since I have not done this in 7, maybe someone else can provide the way of doing it when joined to the domain.

However, are you a Domain User or Domain Admin?

Brink?

Click to expand...

It doesnt matter if your a domain user or domain admin, also, Adding yourself as an Admin to the local PC doesnt work because authentication is delegated to the Domain since thats what you logged onto

You either have to reset the group policy being applied when you logon to auto-elevate administrators or start using biometic, token or card authentication as these will auto-authenticate you with Windows/UAC and your domain

Steven

I have added my domain account as a local admin on the pc. My domain account is NOT a domain admin, just an admin on the local machine. I assume that's working otherwise i'd think after entering in my domain name and password it wouldn't accept it unless it was an admin.

So is this not normal behavior from using win7 joined to a domain? Is there a security/system policy somewhere (on the domain i'd assume) that if set requires you to re-authenticate each time?

dmex said:

It doesnt matter if your a domain user or domain admin, also, Adding yourself as an Admin to the local PC doesnt work because authentication is delegated to the Domain since thats what you logged onto

You either have to reset the group policy being applied when you logon to auto-elevate administrators or start using biometic, token or card authentication as these will auto-authenticate you with Windows/UAC and your domain

Steven

Click to expand...

I have added my domain account to be a local admin on the machine. Are you saying i have to keep re-typing my login info because my login credentials aren't read-able by the local pc?

If i try to open the group policy editor, it says i dont have permission. Is this because it's actually opening a group policy editor for the domain? if i login with my local account (also admin) can i make this change?

thanks for the help

if you're running on a 2k3 domain policy, the network admin will need to get the new gpolicy management console in order to provide your windows 7 machine it's necessary secpol settings. the current adm files are no longer sufficient for the new windows 7 or server 2k8 admx files. Once the group policy is setup properly on the domain your UAC will be disabled and you'll no longer be prompted all the time.

So,, effectively disabling UAC on the local machine? Is that necessary in a domain environment?

Well,, to my knowledge,, yes,, if you are doing things that are local to the system,, adding yourself as a local admin to the PC will make you an admin on that PC weather you are logged in as a Domain User or not. And should allow UAC to be cleared with a simple Yes or No instead of being prompted for userid and password. This is my understanding anyway, as unfortunately I have not had to deal with it yet on 7, but it is this way on XP.

hmm, well then i guess something weird is going on since it's definitely prompting me for a user/pass with every uac prompt. You're saying as long as i made my domain account a local admin, i shouldn't see this behavior? any ideas where to start looking as to why it's acting this way? I dont want to disable UAC - i just want it to go back to a yes/no prompt.

Unfortunately I do not have a domain setup and don't plan on it for some time.
Yes,, if you add your Domain User account to the local admin group of the PC, it will give you admin rights on that PC.

You should be able to do it through Control Panel Users I think.

How this will affect UAC however, I do not know. I would think it should go back to just Yes/No and not prompt, but I don't know.

oh you misunderstood - i have already added the domain account to the local admin account. I assume that part is working otherwise it would reject the user/pass for the uac prompt.

So maybe this isn't bug but some sort of design feature. I'll have to do some googling or post on the msdn forums and see what comes up. I'll post back here if i find an answer.

"you may need to add yourself as an Admin to the local PC."

Click to expand...

-Just like when you are using Windows 2000 in a network, you have do manually add the username and passwords of each user who will be connecting to the Win2000 machine under "Local Users and Groups".

"authentication is delegated to the Domain since thats what you logged onto"

Click to expand...

So, can't you assign that information into the machine that controls the Domain, or is it untouchable? You ought to ask your Administrator if they can set that up for you.

I dont have admin access on the domain level although I can ask the admin. I just dont know what i should be asking him. What specifically would have to do to enable me to get a yes/no uac prompt?

thanks

i have two accounts - one local account, which has admin rights, and then my domain account. I logged on with the local account and added the domain account to the local admin group, which is how the domain account now has local admin rights.

But if this is how UAC is supposed to behave in a domain, i guess i'll stick with it for now. Seems pretty annoying though to have to constantly type in my user info. Hopefully once i finish setting up the machine it wont be much of a bother.

thanks for looking into it

Well,, this is similar to Linux.
This is security measure that a lot , I mean a lot of people complained was missing from Windows.
however, it has always been there,,,, but your were admin out of the box since day one and no one was taught to use a standard user account (as it should have always been) and use Run As to elevate privileges.

UAC is a (crude {for lack of better word]) work around, to make it a bit easier on most people.

In other words, People need to get used to it if they want real protection from viruses,, and in all honesty, UAC should be Disabled and you should run as a true standard user and elevate with admin as needed. Like you should do in XP. People would see a lot few infections.


In other words,,,, none of your accounts should have admin rights to the local PC.
And you should have a separate admin account to elevate privileges.

And that admin account,, should not be called Admin, in any way, shape, or form and the built in admin should be disabled. This is the real way a user PC should be setup. But no one does it cause as you said it is a pain and too much hassle, till they get infected.

I'm not trying to lecture you or flame you in any way,, just stating some facts for everyone.

No worries about the lecture. I actually knew all that. But like many people i'm just too lazy to bother doing that. i feel safe enough running an AV program and not doing anything obviously stupid.

On a strange note, today i've gotten the UAC prompt and it's back to a yes/no prompt. I guess maybe there was some windows update or something that I've since installed that resolved it? Or maybe i had an update that needed a reboot that was causing it? I certainly haven't made any system changes.

Or did you reboot after adding yourself to local admin?
Because I forgot to mention that step.. have to logoff and back on for the admin previledges to take full effect.

That is very possible. I know i didn't reboot specifically because i made myself admin. I would have only rebooted if there was an update that required it. I wasn't aware you needed to log off and on for it to take full effect. That was probably it. See what happens when you assume i know something?

thanks again

Well,, if/when you get a chance,,, can you do an experiment and remove yourself from Admin and reboot,, then see if the prompt returns then put back and reboot,,, see if this really is making this change?

It would be interesting to know and much appreciated.

reboot wasnt needed - just logging on and off reproduces the behavior.

removed my domain account from the local admin group. I could still elevate privledges without any issues. Logged off and back on. I could no longer elevate. Got a user/pass prompt and it wouldn't accept my domain credentials. I had to use the local credentials. I then added my domain account back in. At this point it still prompted for a user/pass, but it would accept my domain credentials. Logged off and back on and UAC was back to a yes/no prompt.

I guess windows is doing the web equivalent of setting a cookie when i log in saying i have admin rights.