How can I block the group policy from disabling uac?

Question

Where I work, our group policy disables UAC for the handful of users that don't know how to make certain applications work with UAC enabled. I don't need UAC to be disabled. Is there a way I can set permissions on keys in the registry or something so that I can enable UAC and keep it enabled even though the group policy is configured to disable it?

Thanks

Our admin said I should enable UAC and reboot on a daily basis because he does not want to change the group policy file — Roberto Murphy, Dec 07 '15 at 16:01
When your machine is infected with malware just remind mgmt that the admin decided it was better than making the apps work properly — Jim B, Dec 07 '15 at 16:09

score 2 · Accepted Answer · answered Dec 07 '15 at 16:03

Group policies are there so that users can't randomly change things themselves. The problem with UAC is that changes are only applied when you reboot your pc and then the Group Policy applies again disabling the UAC.

I would very strong advise against changing regkeys permissions but if you would especially because the UAC key is found under the system subkey of the local machine and would probably yield very undesirable results.

What you can do, if you are the sysadmin, is create a separate OU for computers that would like UAC to be enabled and copy all group policies over except the one disabling the UAC. Then you can configure the UAC as you like.

Good idea, maybe I can talk the admins into creating another Organizational Unit. — Roberto Murphy, Dec 07 '15 at 16:11

score 0 · Answer 2 · answered Dec 08 '15 at 18:45

I highly recommend taking a look at the Microsoft Application Compatibility Toolkit (ACT). This tool is specifically designed to allow legacy or poorly-written applications which do not properly function under newer operating systems and their improved security model. You can create an ACT configuration for any application, and then deploy it via Group Policy,

In my environment, we use several legacy application which don't properly conform to the newer Windows security model, specifically UAC. ACT allows us to configure that application to bypass UAC prompts under certain circumstances.

How can I block the group policy from disabling uac?

2 Answers2