Windows 10: Disabling CMD and BIOS for non admin accounts Domain

Hello dear people of Tenforums. ive used this site everyday since i started my job as head of IT in the local goverment office i work. and i have learned alot like making a new DC

Anyways to the point.

The systems implemented in the 4 schools of the local goverment are old and lacking. they ran on a win 2003 server with users dating back to 2004. instead of cleaning it up i set up a new DC with server 2016.

After spending some times in the school i found pc's riddled with gaming software and pop up's (viruses).
i reinstalled 97 pc's so far this summer and implemented anti viruses.

im here to ask for help doing something else tho. I want to restrict access to CMD and BIOS. most of the time i read about Group policy blocking cmd. but this would be tedious as all pc's will be configured for remote access to remotely help them. having to then logg onto admin acc and disable the policy would make it impossible to remote fix pc's. some of the schools are rather far away from my IT office as well.

Id like to set it up so if you try and start cmd it will ask for admin credentials either from the local pc or the domain admin account. is there a way to do that?

i would also like to block access to BIOS as these children "explore" everything they can.

:)

 

Admin Account Disabled


I am glad that the problem is fixed.

It occurs to me that [whilst I know nothing about domains] since you now have your working Admin account & a spare Admin account you might want to make a system image then connect to that domain again.

• I suspect that the domain might only mess up Admin accounts that you are currently logged into at the time & leave your other Admin accounts alone.
• If this is true then you could routinely make a temporary [sacrificial] Admin account to connect with so that your normal accounts were kept safe.

All the best,
Denis

 

Domain admin account as built-in admin account


I just upgraded two brand new pc's from Win 7 to Win 10. Computers were already added to the domain in Win 7 and I was logged into the domain administrator account when I did the upgrade to Win 10. Now when I am logged in with the domain administrator account, I can't open Edge. It says "This app can't open. Microsoft Edge can't be opened using the Built-in Administrator account. Sign in with a different account and try again."

How do I get the local "Administrator" account to be the Built-in administrator account?

The list of user accounts are:
admin (local admin account I made in Win 7)
Administrator (I assume local administrator account that is automatically created)
administrator.AESSEINVLTD (domain admin account I am logged in with)
Default.migrated
Public.

 

RDP to non-admin account not working


I can RDP to an account that is an admin account but not to a non-admin account.
I have read to check the users and make sure the appropriate accounts have been added to the user list but the option to view or edit the user list is missing from my settings window:



[Advanced Button:]



is there something I can check/change in the reg editor or in group policies or something to make this appear or perhaps just to enable it directly for that account?
For reference this appears the same if I'm logged in as admin or as non-admin. (have to give admin privileges anyway to see this window in the first place)
Thanks to anyone who can help