0

I have a few users who need admin rights on their win11 PCs to install/remove exotic softwares without asking for IT help. Is it possible to let them know the local admin user account/pwd but force them to login with their AzureAD account and only validate with local admin account when required.

They often find it easier to use the local admin account or even to create an other local admin, which I think is too high a risk for an enterprise pc. thx

MM VA
  • 1
  • 1
  • `even to create an other local admin, which I think is too high a risk for an enterprise pc.`. It shouldn't be. Your normal daily processes for identifying unauthorized local accounts should be disabling those and identifying the offenders. – Greg Askew May 25 '23 at 11:49
  • user has to be allowed to install as an admin. what I would like is to disallow the admin account interactive login. only elevation. – MM VA May 26 '23 at 07:00

1 Answers1

0

Yes, there is a way and I have written an article about it. The described method in short: use scheduled tasks to trigger admin account enabling only when selected users logon, so that at the logon mask, these admin accounts can't be found. https://www.experts-exchange.com/articles/24599/Free-yourself-of-your-administrative-account.html

Bernd Schwanenmeister
  • 482
  • 2
  • 5