Forum Discussion
Kiril
May 21, 2024Iron Contributor
UAC during OOBE (after switching from Admin to Standard user in Windows Autopilot)
We switched settings in Windows Autopilot to make the user a standard user instead of an admin. Now, during OOBE I am asked multiple times to execute a PowerShell script as an admin. Wha...
- May 22, 2024it must be an app or powershell script.. so if you are noticing that that policy being mentioned in the ime.. there must be an app being downloaded /executed just before.... Use cmtrace to look at the ime log ..
Kiril
May 22, 2024Iron Contributor
Looking through the logs, the name of the script being executed contains a userId and policyId (userId_policyId.ps1).
How can I find out which policy is triggering this by policyId?
How can I find out which policy is triggering this by policyId?
May 22, 2024
it must be an app or powershell script.. so if you are noticing that that policy being mentioned in the ime.. there must be an app being downloaded /executed just before.... Use cmtrace to look at the ime log ..
- KirilMay 22, 2024Iron ContributorGot it, it was a PowerShell Script. I didn't see it the first time I checked, because of the tab in Scripts and Remediations... Thank you all for pointing me in the right direction.
- May 22, 2024Feel free to mark a reply as your answer 😛