GPO for Elevated Rights

%3CLINGO-SUB%20id%3D%22lingo-sub-1196727%22%20slang%3D%22en-US%22%3EGPO%20for%20Elevated%20Rights%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1196727%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20there%20a%20good%20way%20to%20setup%20via%20Group%20Policy%20the%20ability%20for%20accounts%20with%20local%20administrator%20rights%20only%20to%20open%20certain%20executables%20(not%20all)%20without%20a%20UAC%20prompt%3F%26nbsp%3B%20THings%20like%20mmc.exe%20%2F%20regedit.exe%20%2F%20etc.%3C%2FP%3E%3CP%3EThis%20is%20more%20of%20a%20convenience%20thing%20as%20there%20are%20a%20group%20of%20executables%20we%20would%20like%20to%20avoid%20UAC%20Prompts%20on%20constatntly%20but%20only%20for%20administrator%20rights%20accounts.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%2C%3C%2FP%3E%3CP%3EWhat%20is%20the%20best%20way%20to%20give%20elevated%20privileges%20to%20a%20certain%20folder%20or%20file%20in%20Windows%20and%20alow%20only%20certain%20users%20to%20have%20the%20rights%3F%26nbsp%3B%20The%20best%20thing%20I%20have%20right%20now%20is%20under%20Computer%20Configuration%20%2F%20Policies%20%2F%20Windows%20Settings%20%2F%20Security%20Settings%20%2F%20File%20System%2C%20adding%20the%20folder%20or%20file%20there%20and%20then%20adding%20an%20AD%20User%20Group%20to%20security%20of%20the%20file%20or%20folder%20and%20giving%20that%20group%20full%20rights%20to%20it.%26nbsp%3B%20Looking%20to%20see%20if%20that%20is%20best%20or%20if%20another%20option%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1196759%22%20slang%3D%22en-US%22%3ERe%3A%20GPO%20for%20Elevated%20Rights%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1196759%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3Esince%20your%20question%20is%20about%20Windows%2010%2C%20please%20post%20it%20in%20the%20correct%20community%2C%20Thank%20you%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fwindows-10%2Fct-p%2FWindows10%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fwindows-10%2Fct-p%2FWindows10%3C%2FA%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Is there a good way to setup via Group Policy the ability for accounts with local administrator rights only to open certain executables (not all) without a UAC prompt?  THings like mmc.exe / regedit.exe / etc.

This is more of a convenience thing as there are a group of executables we would like to avoid UAC Prompts on constatntly but only for administrator rights accounts.

 

Also,

What is the best way to give elevated privileges to a certain folder or file in Windows and alow only certain users to have the rights?  The best thing I have right now is under Computer Configuration / Policies / Windows Settings / Security Settings / File System, adding the folder or file there and then adding an AD User Group to security of the file or folder and giving that group full rights to it.  Looking to see if that is best or if another option?

 

2 Replies
Hi,
since your question is about Windows 10, please post it in the correct community, Thank you
https://techcommunity.microsoft.com/t5/windows-10/ct-p/Windows10

Thanks @HotCakeX!

 

@Brian Samec Hello! You've posted your question in the Community Discussion space, which is intended for discussion around the Tech Community website itself, not product questions. I'm moving your question to the Windows 10 space - please post Windows 10 questions here in the future.