How to set up a local administrator account with elevated privileges, but without the rights of local access connection

I want workstation installation a Windows 7 where regular users only have power user rights, because I do not want that they either accidentally change important settings or for malicious to be processes able to run Web sites. However that these will be remote users there maybe times when they need a local administrator account to allow them to perform installation, correction or updating. So, I created a local user account, added to the Administrators group and used the Panel of local security policy and the account added to the list "Deny log on locally '.

It works by refusing the admin account to connect directly. However when I log in under the power user account and run something that requires elevated privileges the admin account is refused to carry out the process.

What is the combination of security settings can I refuse a desktop session Admin account but allows it to be used for processes requiring elevated privileges?

Thank you!

Hello

Thank you for contacting Microsoft Community.
This is quite normal. When you refuse the privileges of local access connection, local users can not use the administrator account information because it is be the local login. So, it is better to create a domain and restrict the use of administrative operations to the administrator.

Tags: Windows

Similar Questions

Maybe you are looking for