Quake3World

This one has me stumped for a good solution....

We have a lot of users who roam and a large number that are 100% roaming users that access our network exclusively via VPN and are a few hundred miles away from the nearest 'real' network link in to us.

We're going through a process right now of locking down laptops so users do not have administrator access.

The problem now is that because the VPN is established within the user's logon session, we can't remote control and switch to an administrator account to make changes to the machine.

Does anyone work with a similar environment and have a decent solution. So far the best idea is to connect with remote management, grant the user temporary admin rights, then have them log off and back on and re-establish the VPN. Carry out the work, demote them, then log them off. This seems a bit clunky.

Any insight greatfully received.

It depends on the kind of tasks you're trying to perform remotely. On my placement job we had a very similar situation to yours.

However, depending on the task there was normally a way round it, for example, when launching a setup file to right click > run as and put in admin credentials.

We've sort-of painted ourselves into a corner because the GPOs we apply are fairly restrictive in locking out the control panel and CMD prompt.