Running commands like Regedit as a standard user
Hello, We are in the process of testing and rolling out Windows 7 Enterprise. I have an issue that appears to be UAC related, but I am not sure. Regedit is manifested to run at highestAvailable and uiaccess is false. Thus, it should run as a standard user. However, when I run it as a standard user I get a messaget that the application has been blocked by group policy. There are no software Restriction Policies in effect on the machine. The UAC is on and set to elevate administrators automatically, and to deny elevation for standard users. This is configured by group policy. This also happens with mmc.exe. I have been over our other policies and I don't see anything that would cause this. Has anyone else seen this? I don't understand why regedit is subject to a UAC prompt as a standard user, considering how it is manifested. Thanks, David
May 3rd, 2010 10:37pm

I can open "regedit" with an standard user in Windows 7, not administrator. I can view and change values under "Current User", but only can view values under "Local Machine" (cannot change). This is why I make sure I'm running regedit as standard user. By the way, I found this problem can be caused of MMC setting in you group policy. Please refer to: http://support.microsoft.com/kb/931865/en-us 1. Open group policay editor. 2. Expand "User Configuration", and then expand "Administrative Templates". 3. Expand "Windows Components", and then click "Microsoft Management Console". You can try changing some settings under "Microsoft Management Console" to do a test. Good Luck! Best Regards, Calven
Free Windows Admin Tool Kit Click here and download it now
May 10th, 2010 6:31am

dave, In addition to Calven's post. You have probaly a GPO that denies access to registery editing tools. Check this link for more info ... http://windowsxp.mvps.org/tweakuirest.htm. Kind Regards DFTIM me - TWiTTer: @DFTER
May 10th, 2010 4:40pm

I don't think that's it, daft. I don't ge the message that users have been denied access to registry editing tools. I get a message that the command is blocked by group policy. I can't for the life of me find where it might be blocked in group policy We don't have Vista in our environment, so this is our first exposure to UAC as a company. Still wondering... Dave
Free Windows Admin Tool Kit Click here and download it now
May 13th, 2010 2:35am

Dave, An other posiblity is that you have some software restriction policies (SRP's) that deny you access to the certain files. Check you event log if there are some messages that tell something about software restrictions. More info about SRP's is aviable here : http://technet.microsoft.com/en-us/library/cc786941(WS.10).aspx Kind Regards DFTIM me - TWiTTer: @DFTER
May 13th, 2010 1:54pm

Hi One way to find out if it is a GPO that is causing the problem is to create a new OU and put the computer account and a user accunt in that OU then block all GPO to that OU. Login to the computer with the account that is in the new OU and se if you get the same problem. If not then it is a GPO that is causing the problem. Just make sure that your DC has replicated the new OU and the move of the account to all dc's Best Regards Chris Steding MCTS Windows 7 Configuration www.compit.se
Free Windows Admin Tool Kit Click here and download it now
May 14th, 2010 10:47am

I can confirm, that this issue happens to registry editor, Task Scheduler etc if the policy Automatically deny elevation requests is configured (which should help to avoid unnecessary popups for standard users, causing them to call the helpdesk). If I change this setting, regedit pops for Admin credentials instead of running in the current users context. This is a very unwanted and annoying side effect of the above GPO, as well as also the manual infliction of Run as Administrator does not longer work. What I want, is blocking automated popups for user name/password if an application "thinks", that it wants Admin permissions for convenience, but I still want this, if I explicitely select Run as Administrator. Also still not found a workaround for this. Best greetings from Germany Olaf
July 22nd, 2010 11:06am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics