Why would two devices in the same OU have UAC prompting differently?

Posted by This_guy_works@reddit | sysadmin | View on Reddit | 9 comments

I created a test OU in AD for two of my PC's I am working with. I created a GPO for that group with user account control settings to prompt for credentials whenever something requiring administrator rights is ran. I am using an HP desktop and an HP laptop. The laptop works great after moving it to the OU and updating the group policy - When anything requiring admin rights comes up, it will darken the screen and prompt for admin credentials to run. However, on the desktop with the same user account logged in and in the same OU, it will darken the screen and give prompt to continue, but not ask for credentials. Just allow or deny. I am finding this very bizarre. Prior to moving to this OU, both devices ran everything without prompting/warning, which is the current standard, and I could install anything. For obvious reasons I want to enable UAC controls so standard users cannot do admin tasks without proper credentials. I am just not sure why the laptop is working as intended, but the desktop is not. Both devices are running the same version of Windows 10 (22H2) and both are logged in with the same user account and both have had their group policy updated and been restarted. Both of them are showing up the same results in the local group policy editor as having the same UAC settings enabled under computer configuration > windows settings > security settings > local policies > Security Options. I'm just not sure where to go next on this one. The only other clue I have is that the desktop was imaged a month ago, and the laptop was just imaged a couple days ago and joined to the domain. Is it possible there might be something overriding UAC or group policy in the older setup that isn't there on a fresh install/domain join?

9 Comments

[-]

jeezarchristron@reddit

It sounds like the one that doesn't require a PW is logged in with an admin account. Check to see if that user is local admin.

This_guy_works@reddit (OP)

Alright, yeah. I feel dumb. That was it. They set me up as local admin on my PC during staging, since I am IT. That's why the desktop was not asking for credentials, but still prompting.

It happens to us all, no reason to feel dumb.

RancidYogurt@reddit

This. Since you have two different machines, your user account may be configured with local admin privileges on one of them.

Ok_Internal9295@reddit

I've had it where GPOs were not applying properly on some systems to where I had to modify the registry key instead (which is basically what the GPOs do for you). I would double-check the Windows 10 UAC registry settings on each and see if it still shows as good there. Other than that...like someone else mentioned here, I would verify they aren't in any local admin groups that may change the way UAC interacts with them on that system.

_BoNgRiPPeR_420@reddit

RSoP and gpresult are your friend in these situations. They can spit out a report and tell you what policy is changing what settings. It's possible another policy has that machine scoped out, either through permissions or item-level targeting. It could also be in an SCCM collection that overwrites the setting.

katwanjmur@reddit

Check the UAC settings on both devices. The UAC level can be adjusted, ranging from disabling it completely to setting it to the highest level. Check that the UAC settings are consistent between the two devices.

Review the desktop's history, logs, or any post-imaging configurations to identify any changes that might affect UAC settings. Compare the registry entries related to UAC between the two devices to identify discrepancies. Consider temporarily disabling or uninstalling any software that might interfere with UAC settings to see if it affects the behavior. Run diagnostic tools to check for any domain join issues or conflicts. You could also perform a thorough comparison of the image configurations and any subsequent changes made to the desktop after imaging to pinpoint the potential cause of the differing UAC behavior.

seaking81@reddit

Do you use Cisco ISE? We have policies there for UAC through Cisco Anyconnect

Reply to Post

9 Comments