locked
Access control panel with elevated rights RRS feed

  • Question

  • Hello,

    We implanted new GPO rule, to block Control Panel for users. Now we would like to have ability to run As different user and able access from current user profile and save time to not switching accounts.

    I tried navigate to C:\Windows\System32\Control.exe and run "As Different User" - does not work. I'm running as administrator and admin account are not effected by this GPO.

     I hope there is way to access Control Panel from restricted user, otherwise we need find different solution to block control panel for regular users and not for admins.

    Wednesday, January 31, 2018 4:37 PM

All replies

  • Hi,

    Could your administrator user account run the C:\Windows\System32\Control.exe?

    If yes, I think you could create a shortcut for other standard users that you want them to access the Control Panel.

    Here are steps:

    1. Make sure the administrator account is enabled.

    2. Right click the desktop to create a shortcut.

    3. Enter the command:

        runas /user:ComputerName\Administrator /savecred “C:\Path\To\Program.exe“

    Example:

        runas /user:win7\Administrator /savecred “<C:\Windows\System32\Control.exe>”

    4. Customize the shortcut.

    5. The first time you double-click your shortcut, you’ll be prompted to enter the Administrator account’s password. This password will be saved – the next time you double-click the shortcut, the application will launch as Administrator without asking you for a password.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    • Edited by Vera Hu Thursday, February 1, 2018 7:10 AM
    Thursday, February 1, 2018 7:10 AM
  • This option do not work, when you have this GPO rule enabled. I already tried and Administrator account does not able run
    Thursday, February 1, 2018 9:07 PM
  • Hi,

    In original post, you mentioned ” I'm running as administrator and admin account are not effected by this GPO. ”

    Is that the GPO only apply for non-administrator user account?

    If no, please try to set the GPO only apply for non-administrator user account, then see if the administrator account can run the C:\Windows\System32\Control.exe.

    Is there any error message when administrator run the .exe file?


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Proposed as answer by Vera Hu Tuesday, February 6, 2018 9:40 AM
    Friday, February 2, 2018 9:38 AM
  •  

    Hi, 

    How’s everything going? Please feel free to give me any update.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, February 6, 2018 9:40 AM
  • GPO applied only on non-administrator accounts. When i try run "control.exe"  as different administrator user (from regular user profile), i'm getting the same error like a regular user.

    If i want to access control panel, i have to login as administrator and this is not very efficient.

    Thursday, February 8, 2018 3:15 PM
  • Also i forgot to mention, this is 2008R2 Domain Controller and Windows 7 workstations
    Thursday, February 8, 2018 3:16 PM
  • Hi,

    From my test and research, if you could prohibit access to Control Panel through GPO or registry.

    But if you want a user which is prohibited access to Control Panel to access it without switch the user account, I think there is no method for you to achieve it.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, February 14, 2018 6:58 AM