Running Microsoft Management console (MMC) as a standard user without Admin privileges

We had an interesting question posed to us about allowing standard users to launch and work with the admin tools provided by the MMC, and whether the MMC requires elevated privileges.

We found some interesting thing upon testing, firstly no MMC doesn’t require elevated privileges to run some no UAC prompt will pop for the standard user and they will be able to launch and work the tool although will not be able to make changes without extra permissions, we are just talking about an account that is just part of domain users group.

An UAC consent prompt will be shown if trying to open mmc.exe while logged in with an account that has admin privileges.

We also found that if the standard user was a part of the “Group Policy Creator Owners” and they tried launch mmc.exe then they would be presented with access denied and UAC asking for admin credentials.



Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s