Forum Discussion
Solved
UAC during OOBE (after switching from Admin to Standard user in Windows Autopilot)
We switched settings in Windows Autopilot to make the user a standard user instead of an admin. Now, during OOBE I am asked multiple times to execute a PowerShell script as an admin. Wha...
- it must be an app or powershell script.. so if you are noticing that that policy being mentioned in the ime.. there must be an app being downloaded /executed just before.... Use cmtrace to look at the ime log ..
If you arent deploing powershell scripts or proactive remediations to your devices, it could be a custom made win32app that is being targetted at the user and not running in system context.
So i would start digging in to the intune management extension to find out what is being executed just before you get that prompt
So i would start digging in to the intune management extension to find out what is being executed just before you get that prompt
- Looking through the logs, the name of the script being executed contains a userId and policyId (userId_policyId.ps1).
How can I find out which policy is triggering this by policyId?- it must be an app or powershell script.. so if you are noticing that that policy being mentioned in the ime.. there must be an app being downloaded /executed just before.... Use cmtrace to look at the ime log ..
- Got it, it was a PowerShell Script. I didn't see it the first time I checked, because of the tab in Scripts and Remediations... Thank you all for pointing me in the right direction.
