We're setting up public gaming PCs where customers will sign in with their own game accounts and play through Steam. Installing the games is straightforward, but some titles still request administrator elevation when launched, possibly because of their anti-cheat components or first-run prerequisites. The machines are currently domain-connected, so I'm looking for a secure way to let standard users run only the necessary applications without granting broad local administrator access. I considered scheduled tasks and similar workarounds, but frequent game updates could make those brittle. What setup would you recommend for a gaming-cafe environment?
5 Answers
For public-use machines, use a reset-based design: restore each PC to a known-clean image after logout or reboot with software such as Deep Freeze or Windows Unified Write Filter. A dedicated, non-domain gaming setup can then use broader permissions if absolutely necessary, since the system is rebuilt between users. This still needs strong network isolation and careful testing of game updates.
Use an endpoint privilege-management product rather than making users local administrators. These tools let you approve specific executables and run them elevated under the user’s normal account, without exposing administrator credentials. Products in this category include Admin By Request, AutoElevate, BeyondTrust, and similar tools. Expect to review and update application rules as games and anti-cheat components change.
Admin By Request is worth evaluating first; it supports application allowlisting and may have a limited trial or free allocation for testing.
Check the platform’s official PC-cafe licensing program before deploying anything. Public gaming venues generally need the appropriate commercial licenses and client configuration; customer-owned accounts alone may not cover that use. The licensing program may also provide a better-supported model for shared machines.
The bigger issue is the environment, not just the UAC prompt. These should be isolated gaming stations on a separate network with no access to production systems or domain resources. Avoid having customers use ordinary company computers or domain accounts, and do not give them unrestricted administrator access.
Avoid UAC-bypass tricks such as RUNASINVOKER. They do not actually grant the permissions the game needs and can cause unreliable behavior. Changing folder permissions or elevating the entire game launcher also creates unnecessary security risk, especially when games update frequently.
A clean image per session or at least after every customer is important. Otherwise one user could leave credential stealers, unwanted software, or other malicious changes behind for the next person.