Local Security Policy

[Alan]

Local Security Policy: Does anyone know what the first option, "Accounts:
Administrator account status" does? Seems to have no effect on
standalone/workgroup connected computer. Is it strictly a domain related
thing?

Also I noticed if you disable UAC approval/prompting in the User Account
Control: policies, you can get rid of all those approval/elevation prompts,
let standard users install apps and such. But you also might be prevented
from installing an app, even from an admin account, due to lack or
rights/privileges. For example to install the CA AV program I had to go into
Safe Mode with Networking and install from the Administrator account. Is
that the way it's expected to work in the final product?

 

[Alan Adams]

Local Security Policy: Does anyone know what the first option, "Accounts:
Administrator account status" does? Seems to have no effect on
standalone/workgroup connected computer. Is it strictly a domain related
thing?

No idea.

Also I noticed if you disable UAC approval/prompting in the User Account
Control: policies, you can get rid of all those approval/elevation prompts,
let standard users install apps and such. But you also might be prevented
from installing an app, even from an admin account, due to lack or
rights/privileges.

If you've changed the two "Behavior of the elevation prompt..."
policies in Local Security Policy, what you've done is change the
behavior of what UAC will do once a condition that requires elevation
is detected. (Which is not the same as "disable UAC" or "don't bother
preventing access".)

If you've changed more than just the two "Behavior..." policies (e.g.
if you also turned off "Detect application installations and prompt
for elevation"), then you're in a state where UAC is still enabled,
but is not trying to elevate application installs that require
elevation.

What exactly you've changed, and whether the particular application
install you've cited works correctly even with Vista and UAC in their
default enabled / prompting states, would impact whether what you're
currently seeing could be deemed "expected".

Alan Adams

 

[Kevin]

It enables or disables the local 'administrator' account. My system is not a
domain member so it appears that it is functioning as yours. I can change
the setting and watch the administor account get disabled or enabled... On
my current build (5384) it works as expected. No dependency on domain
membership etc.

Alan seems to have covered the other one.

Kevin