UAC Admin Account Control

Not entirely sure what you're after, but I would suggest using a simple standard account and giving them the permissions they need to use what programs you allow them to use. Also, you can lower the UAC settings to prompt less often or not at all (As they wont be administrative, they wont be able to get around the UAC).

Is there something wrong with my suggestion earlier? I would still recommend it now: giving them limited accounts and going through and upgrading their permissions for items that you would allow. Users were never meant to have administrative access, microsoft has always geared towards them having limited accounts. That way they are in no position to change things you don't want changed. However, in a large company, to do this for every individual computer may take a while, and I am not sure if there is a Group Policy setting that can handle this all at once. You might wait for another respose or look it up in a search yourself. I can help you search a little later, but You'd have to give me a few hours

shadowmind said:

... user knows to call IT if they need to make a change they're not normally allowed to do. But there doesn't seem to be a work around for this when the user is away from the office (MS mentions this on the UAC tech doc). If they are on a 3 month research excursion in the middle of Alaska without a way to call HQ and their computer has issues, they either have to fedex us the laptop, or suck it up till they come home. We want a way to give administrative rights for UAC on a temp basis without giving the user the ability to actually log into that account.

...

Basically we run a draconian lock down while users are on their domain account. But we can't be that hardcore when a user is out of the office on a laptop for extended periods of time. We dont want to give up security for an easy button. ...

Ah, this I do understand, and I can see your difficulty. UAC is very good at keeping people from doing things a company might not like being done, so it is not an easy choice in disabling it.

shadowmind said:

Allowing UAC to verify off a local account, and not allowing that local account to be 'loggable' seems like a happy median. This way we can disable the local account while its on the network and enable it again when they disconnect (I already know how to do this).

If they were to create their own administrative account while away (local), and upon its reconnection at the office, local is disabled, how is it that they can suddenly gain a workaround from the UAC through their newly created account? From a local administrator, is it possible to disable UAC and then have that carry over to the networked account? I guess I don't understand why they would need to create a new administrative account if they already are given their own local admin account when they travel. But I believe you when you say it is what they use to skirt the UAC. Because you said you disable UAC from admin accounts (or it is rendered useless as they know the password) locally, right?

I'll come right off the bat in telling you I myself know of no such program as you requested in your first post, and am limited in what I can offer as a solution. You may very well have an unaddressed issue that is so rare microsoft has no need to address it (as most companies are not as generous to their employees as yours).

It could cost some more money, but you could force employees to save any work they wish to carry with them on thumb drives and have separate "travelers" computers on the ready.

You could request to send out a memo that employees are not allowed to create new accounts on work computers and force them to talk to the "boss" if found out, provided you have or request the power to do so. I know if I was threated to be fired over something like this I wouldn't do it.

I believe there is a built in full rights local administrative account in windows 7 that is disabled through default (So essentially windows creates 2 admin accounts upon installation). You could enable it and set its password common to all work computers (so there isn't a long list of saved passwords per computer), and create another local administrative account for the traveling employee (or use the default one created with windows). When you need to, you can disable and enable their provided local administrative account with your built in one, and remove any that they've potentially created, but all of this would have to be done manually before they left and after their return, and is very time consuming. It would help if you had some paper with specific directions on how to do this, so that could speed up this process some. This process would prevent users from even seeing their admin account on the welcome screen and prevent them from logging in at all locally. But once again this is prehistoric, but I think I'm out of ideas.

shadowmind said:

We want a way to give administrative rights for UAC on a temp basis without giving the user the ability to actually log into that account.

ALTHOUGH, I don't think I know what this means. How can one not log into an account but gain UAC administrative rights? lol but again, I will not be very useful help, as my knowledge here is very limited