Windows 10: is there a way to block computer management for other users that are not admins.

i am trying to disable or block computer management for other users on the computer that do not have admin rights.i enabled it in local group policy but still works for other users. any suggestions?

:)

 

UAC prompt for Task Manager. MMC blocked. What happened?

It's possible that Computer Management is being blocked by SmartScreen. We suggest disabling it and see if it helps. Follow the steps below:

1. Click the Start button.
2. Type smartscreen in the search bar.
3. Click Change SmartScreen settings.
4. Click the drop-down arrow in the Security row.
5. Click Change settings beneath the WindowsSmartScreen row.
6. Click Don't do anything (turn off Windows SmartScreen).
7. Click OK.

 

folder creation and sharing, i want to create an admin user that have only permission to modify folders and file but not have domain admin access.

Hi Mindspaceoutsourcing,

Welcome to Microsoft Community.

I'm Hahn and I'm here to help you with your concern.

To create an admin user with the permission to modify folders and files but not have domain admin access, you can follow these steps:

Step 1: Create a new user account

1. Log in to the computer or server as an administrator.
   
2. Open the "Control Panel" and navigate to "User Accounts".
   
3. Click on "Manage another account" and then "Add a new user account".
   
4. Enter a username and password for the new user account and click "Create Account".
   

Step 2: Add the user account to the local Administrators group

1. Open the "Control Panel" and navigate to "Administrative Tools".
   
2. Click on "Computer Management".
   
3. In the left pane, click on "Local Users and Groups".
   
4. Click on "Groups" and then double-click on "Administrators".
   
5. Click on "Add" and enter the username of the new user account.
   
6. Click "OK" to add the user account to the Administrators group.
   

Step 3: Create a shared folder and grant the new user account full access

1. Create a folder on the computer or server that you want to share.
   
2. Right-click on the folder and select "Properties".
   
3. Click on the "Sharing" tab and then click "Advanced Sharing".
   
4. Check the box next to "Share this folder".
   
5. Click on the "Permissions" button.
   
6. Click "Add" and enter the username of the new user account.
   
7. Select the new user account from the list and click "OK".
   
8. Grant the new user account full control permissions by checking the box next to "Full Control".
   
9. Click "OK" to save the changes.
   

Step 4: Set file and folder permissions

1. Right-click on the folder you want to modify and select "Properties".
   
2. Click on the "Security" tab and then click "Edit".
   
3. Click "Add" and enter the username of the new user account.
   
4. Select the new user account from the list and click "OK".
   
5. Grant the new user account the necessary permissions by checking the appropriate boxes (e.g., "Modify", "Write", "Read & Execute").
   
6. Click "OK" to save the changes.
   

Step 5: Remove the new user account from any other groups with domain admin access

1. Open the "Control Panel" and navigate to "Administrative Tools".
   
2. Click on "Computer Management".
   
3. In the left pane, click on "Local Users and Groups".
   
4. Click on "Users" and then double-click on the new user account.
   
5. Click on the "Member Of" tab.
   
6. Remove the new user account from any groups that give it domain admin access.
   
7. Click "OK" to save the changes.
   

By following these steps, you should now have an admin user with the necessary permissions to modify folders and files but without domain admin access.

I hope this helps. If there is anything not clear, please do not hesitate to let me know.



Your Sincerely

| Microsoft Community Support Specialist

 

Is there any way to filter admin user group to not become primary users for a PC in Intune?

Hi,

We have an SCCM + Intune Co-management in place for our Windows workstations.

We have some legacy steps in our workstation delivery process , which require our helpdesk team to logon to these computers for installing few components before handing them to our end users.

Now we are facing an issue where our admin users will get registered as the primary users of the computers and it requires manual steps to get this changed.

And while admin accounts are primary users, M365 suite installation can't be started from Intune by the real primary user of the device.

Any tips/tricks available how to workaround this? Could the admin accounts somehow be excluded as being primary users of ANY device? As we use dedicated admin accounts, these accounts do not have any computers assigned to them.