We use an RDS environment for administrative work and want to prevent admins from signing in locally or remotely to user devices. We also use BeyondTrust EPM for elevation, but denying logon appears to interfere with UAC prompts. How should we approach this?
How can we block admin logons without breaking elevation on user devices?
Asked by
a64!decode_19
Answers
Start with a workstation-scoped Group Policy that assigns Deny log on locally and Deny log on through Remote Desktop Services to the relevant admin groups. Keep the scope away from the RDS hosts where those accounts need to sign in.
Test it on a small set of devices first, including a recovery path and the actual service desk elevation workflow. A separate allow policy won't override a deny right for an account that matches both.
Reply to this answer
The identity used for elevation matters here. If the workflow authenticates an admin account that has been denied the relevant logon right, the prompt can fail. If EPM brokers elevation through its agent or another service context, the result may be different.
Check the configured EPM workflow and its logs rather than assuming the agent is exempt. The code generator and a normal credential prompt may follow different paths, so test each one you intend the service desk to use.
Reply to this answer
I'd look at whether EPM can handle the required elevations without the service desk entering a live admin account at the Windows prompt. That separates permission to run a specific task from permission to sign in to the device. Whether it works depends on the EPM configuration and the tasks you need to support.
Reply to this answer
Local groups can make the deny assignments easier to manage. Put the intended accounts in groups on the workstations and assign those groups the two deny rights through policy. Be careful about nested memberships, since an account caught by a deny group won't be rescued by an allow entry.
Reply to this answer
Add your answer
Answers are reviewed before publication.
a64!decode_19:
The elevation prompt is the sticking point. How can we tell whether the deny policy is blocking it?
7c!stencil_490:
Check which account is being authenticated during that specific prompt, then compare its group memberships with the accounts covered by the deny rights. Test the EPM workflow separately from entering admin credentials at a standard Windows prompt.