UAC during OOBE (after switching from Admin to Standard user in Windows Autopilot)

[Kiril]

We switched settings in Windows Autopilot to make the user a standard user instead of an admin. Now, during OOBE I am asked multiple times to execute a PowerShell script as an admin.

What causes this behavior and how to prevent?

[#2]

@Kiril 

Not 100 percent sure how you deploy your script but do you have the option "Run this script using the logged on credentials" set to 'yes'? This might cause this behaviour:

[#3]

Thank you. There are no scripts being deployed or executed by Intune. Must be cause by something else.

[#4]

We can't see the name of the script, but is this something related to a application you are deploying in your ESP?

[#5]

The script name is a GUID, there is no actual information about any application. How could I debug this behavior?

[#6]

@Kiril 

When in ESP go to Powershell (using sift f10 to open cmd en open powershell by typing 'Powershell'). Set excution policy to bypass ('set-executionpolicy bypass') You can download/install the Autopilotdiagnostic script (see here). I mostly use the community version because it has more features. 

Install the script with the following line:  'Install-Script -Name Get-AutopilotDiagnosticsCommunity'

I forgot if the community version includes the online option by default but to get the translation from GUID to Name you need the online option. So try run the script with the following line: 'Get-AutopilotDiagnosticsCommunity -online'

[#7]

If you arent deploing powershell scripts or proactive remediations to your devices, it could be a custom made win32app that is being targetted at the user and not running in system context.
So i would start digging in to the intune management extension to find out what is being executed just before you get that prompt

[#8]

Looking through the logs, the name of the script being executed contains a userId and policyId (userId_policyId.ps1).

How can I find out which policy is triggering this by policyId?

[#9 · Accepted solution]

it must be an app or powershell script.. so if you are noticing that that policy being mentioned in the ime.. there must be an app being downloaded /executed just before.... Use cmtrace to look at the ime log ..

[#10]

Got it, it was a PowerShell Script. I didn't see it the first time I checked, because of the tab in Scripts and Remediations... Thank you all for pointing me in the right direction.

[#11]

Feel free to mark a reply as your answer :p