Can a domain account (with admin rights to machines) be enabled and disabled to allow it to be used to update software?

I have a domain environment across two sites. There are very few users who have admin rights to machines – for obvious reasons of users installing what they want, when they want and ignore the consequences.

The two admin accounts (the two senior partners) don’t want to have to keep going to the other site to enter their password as and when the office staff need certain software updating (one software is updated almost monthly). The other additional request is to have an account for our external support companies for some other softwares.

They’ve come up with an idea of creating a couple of accounts that can be added (via Group Policy) to the Administrators group of the office workstations and when someone needs to use it they change the password -> let the user install what they need -> change the password again.

Alternatively, and this is my question, could they create the two accounts and simply enable/disable the accounts when they need to be used so that the users always have the same username/password for the admin elevation? Would a disabled account still allow UAC elevation to succeed?


Source : Link , Question Author : Kinnectus , Answer Author : Community

Leave a Comment