Windows 10: Configure Windows Token-Based Activation between standard user and administrator

I am working with Windows 10 Enterprise Edition and VMware Instant Clones. The Golden Image has the group volume and token-based activation license on it. The situation is when I log into a virtual machine with my regular smartcard, the activate windows display is seen and the activation never occurs. When I log into the same virtual machine with my admin card, the activate windows display will disappear and the activation is successful. So I know the token-based authentication works, but I can't find any documentation on how to get the activation with a regular user smartcard.

:)

 

Elevating/Accquiring the Admin Token in Administrator vs Standard Accounts in Windows

I've recently been confused by how UAC works between Standard accounts and Administrator accounts,

As we all know, when UAC is turned on, UAC allows Standard Accounts or Administrator accounts in Admin Approval Mode to gain access to the administrator token in order to perform tasks that require administrative access to the machine - allowing us to switch
tokens without switching users,

However, it appears that switching tokens is not really what happens: A while ago, I ran an application that would modify the shell (explorer.exe). I ran the program in a Standard Account, but it needed elevated access: therefore, I used UAC to supply admin
credentials so it could complete. I did not seen any change to the shell; I then logged into the administrator account whose credentials I used and I saw that the shell in that account had been changed, which was obviously not what I wanted

It appeared to me that UAC was just basically a "Run-as user" type deal where it actually ran the program as that user. This meant that I wasn't just running it elevated: I was literally running the program as that user,

My question is: is it possible for a standard account to use the administrator token but actually run the program as a standard user and use the current user's profile? Otherwise, it seems to me that if you need to do any administrator tasks, you are pretty
much required to log in to an administrator account which defeats the whole purpose of UAC - since UAC runs a program as the administrator, rather than using just the administrator rights,

Is this separation of token and profile possible? Or do all users just have to be administrators in that case? It seems to me this would account for many organizations just granting full administrator access to all users,

Can someone please shed some light on this?

I would like to know if it would have been possible to supply an administrator token to the said program, but run that program in the current user account, not the user account of the administrator whose credentials were supplied - in other words, would it
have been possible to modify the shell in the Standard account with that program? The goal would be to launch the process as the logged in user (regardless of current privileges) with administrative rights, not as a process under an account with admin rights.

I am not referring to Admin Approval Mode or how UAC works. I already know that if UAC is set to a secure setting, even Administrators will be prompted and unless it is turned off, administrators use the standard token by default. I am talking about when
the administrator token is gained, is it possible to still run the process as the logged in user, just with the admin token? (not using Run As 'user' but maybe something like run as/with 'token'), etc... In this way, it would be using generic administrative
privileges rather than one user's administrative privileges.

Is this at all possible, or have I just pointed out a feature not in Windows by design or something?

Would I, to achieve the goal described here, have to perhaps turn the standard account into an administrator account any time anything that requires elevation needs to be done, and then turn it back into a standard account when done? Based on comments, it appears
that this is not possible and that seems to be a flaw in the OS because it makes UAC basically useless.

Hope this makes sense,

 

Standard user account created shows Administrator on Windows 10

Hello,



Thank you for posting on Microsoft Community. We regret the inconvenience caused and will assist you in resolving the issue.



Before assisting further, I would like to ask you few questions:

• Are you logging in using a Microsoft account on any of the created two user accounts?
• Have you created 2 local account with administrative privileges on the computer?

Please be informed that Local user account as well as
Microsoft user account can be considered as Standard user account. A
Standard user account is the user account which do not have any administrative privileges.



It is possible to create two or more accounts with administrative privileges on computers running with Windows 10 operating system.



If you want to convert one of the user account as a standard account, I suggest you to follow the steps below and check if the issue is resolved.

• Press Windows logo key on the keyboard, type Control panel in the search box and select the top most search result.
• Select User Accounts and click on Change account type
  from the window.
• Click on the user account and select Change the Account type option.
• Select Standard and click on Change account type
  button from the window.
• Close the window and check if the changes are effective.

Write to us with the answers to the above questions and the status of the issue on the same post for further assistance. Your reply is most important for us to ensure we assist you accordingly.



Thank you.

 

Is there still reason to use standard user account in Windows OS?

Hi all!

Suppose I'm the only user of the computer. Suppose I have User Account Control activated. Is there or are there still reasons to create and use standard user account for everyday work? As far as I understand, with User Account Control active I have the permissions of a standard user even if I'm logged on as an administrator. If I use administrator account for everyday work does User Account Control give me EXACTLY the same level of protection from viruses and malware and from making accidental system-wide changes as standard user account with active UAC? I don't imply that UAC protects me from viruses and malware. I use proper antivirus software for that.

In other words, do I get the same level of protection when I use administrator account with UAC enabled and when I use standard account with UAC enabled? Is it true that UAC turns an administrator account into what is know as a protected administrator account, basically, an administrator account that runs with standard user account privileges? Or does standard user account with UAC enabled gives me yet higher level of protection over administrator account with UAC enabled?