Is there something like a sudoers list in Windows?

Question

In UNIX-like systems, normal users can obtain higher priviledges using the sudo command (or they can temporarily switch the user using su). However, with a properly configured sudoers and PAM file, you can prevent normal users from gaining higher priviledges completely, such that even if they were in possession of administrative credentials, they would have to login as that user.

In Windows UAC, whenever some application requires higher priviledged access, the currently logged in user is asked to type in the credentials of an priviledged account.

I was wondering if Windows provides a similar mechanism to sudo, to prevent normal users of getting higher access completely.

Answer 1

Windows will by default (in most cases) prompt for Admin credentials when an action requires elevation. This behavior is controlled by the “User Account Control: Behavior of the elevation prompt for standard users” group policy. If set to “Automatically deny elevation requests”, the prompt will not show up.

This will, however, not prevent the user from using runas or similar tools to run a program with known Admin credentials. These methods are not related to UAC. The Explorer context menu entry can be disabled using the HideRunAsVerb DWORD at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

To fully harden a system, you need to use AppLocker to prevent execution of all unknown/undesired software.