Forum Discussion
Solved
UAC during OOBE (after switching from Admin to Standard user in Windows Autopilot)
We switched settings in Windows Autopilot to make the user a standard user instead of an admin. Now, during OOBE I am asked multiple times to execute a PowerShell script as an admin. Wha...
- it must be an app or powershell script.. so if you are noticing that that policy being mentioned in the ime.. there must be an app being downloaded /executed just before.... Use cmtrace to look at the ime log ..
If you arent deploing powershell scripts or proactive remediations to your devices, it could be a custom made win32app that is being targetted at the user and not running in system context.
So i would start digging in to the intune management extension to find out what is being executed just before you get that prompt
So i would start digging in to the intune management extension to find out what is being executed just before you get that prompt
Looking through the logs, the name of the script being executed contains a userId and policyId (userId_policyId.ps1).
How can I find out which policy is triggering this by policyId?
How can I find out which policy is triggering this by policyId?
- it must be an app or powershell script.. so if you are noticing that that policy being mentioned in the ime.. there must be an app being downloaded /executed just before.... Use cmtrace to look at the ime log ..
- Got it, it was a PowerShell Script. I didn't see it the first time I checked, because of the tab in Scripts and Remediations... Thank you all for pointing me in the right direction.
- Feel free to mark a reply as your answer 😛