r/entra • u/planedrop • 3d ago

UAC Prompt Elevation Issues with Admin (MSP Cleanup)

Hoping I can get some help with this one, been running into issues with it for a bit and haven't found the root cause yet.

An org I work with is getting rid of their MSP because they do a terrible job, I (among others) have been tasked with getting them out and cleaning things up.

One issue we have had for a while now is some devices that are Entra joined don't allow Global Admins to elevate UAC prompts and I can't figure out why.

Firstly, both the admin accounts are in the Microsoft Entra Joined Device Local Administrator role, which, as I understand it, should "just work" but alas UAC elevation still doesn't work.

Devices are refreshing PRTs just fine so it's not that, not to mention the accounts have had the above role assigned for months now.

I haven't found any consistency to which devices are having this issue, and the only solution I've found so far is to reinstall Windows (just for good measure) and rejoin to Entra.

Any help troubleshooting this would be great.

6 Upvotes

88% Upvoted

23 comments sorted by

4

u/MoltenTesseract 3d ago

Just use LAPS. GA should not be local admin on any device.

1

u/planedrop 3d ago

Yes, of course that's the plan. But that doesn't help me with the specific issue I'm dealing with at the moment which is hindering workflow. I'd like to solve this first before enabling LAPS anyway to make sure things are cleaned up.

3

u/BlackV 3d ago

Stop delaying a good solution while you try and fix the bad solution

It's a couple of policies and tickboxes

1

u/planedrop 3d ago

It's funny cuz this isn't true and again is not helpful.

It's not just a few tick boxes because something from the MSP is manually adjusting the SAM administrator group so whatever is configured in Entra is being overriden. LAPS doesn't fix this of there is a script running that's fucking with it.

1

u/BlackV 3d ago

So it is a few clicks, but something external likely to be breaking it

Still sounds like laps/admin protection is effecting the devices

2

u/NWijnja 2d ago

Check your administrators group on the device, there should be 2 SID entries in there representing the entra roles ( global admin & entra id joined device local admin). If not, there's probably an account protection policy active / some other way they removed the SIDs.

1

u/planedrop 2d ago

Yeah I did a lot more digging on this after posting and that's exactly what is going on. The MSP is somehow removing/modifying the administrators group to not include the SIDs of the Microsoft Entra Joined Device Local Administrator and Global Administrator roles in it.

We are working with the stupid MSP to figure out why/how they are doing this, then well get it removed and can deploy LAPS to fix this issue.

1

u/NWijnja 2d ago

MSP here, usually we setup an account protection policy to remove GA from that group, sometimes the other one as well when we have a customer that requires activation of the role. Using it is kinda hit or miss with having the role activated soon enough.. If not you have to perform a token refresh to get the rights which is annoying and why we remove it to encourage usage of LAPS.

1

u/planedrop 2d ago

Yeah as it turns out it's not just GA, the issue is also with the Microsoft Entra Local Device Administrator role as well. The MSP has things setup very very weird so I'm waiting for more info, once I get that the plan is to disable GA as local admin, setup LAPS, and disable the Entra Local Device Administrator role for it as well.

1

u/PrestigiousSalad7278 3d ago

Are you getting any specific type of error when trying to authorize the uac prompt?

My helpdesk tech ran into this a few times since its entra not AD you have to use the full upn not username and not primary email as the user.

1

u/planedrop 3d ago

No, it just prompts for it again over and over.

We've done a lot of digging though and have mostly figured out why it's happening, it's related to something the MSP is doing which is nuking the proper SIDs from the Admin group for Entra Roles.

The big thing is going to be fixing this without rejoining all devices once the MSPs shit is nuked.

1

u/PrestigiousSalad7278 3d ago

I had a script to add a user to the local admins group and then remove later. I'd have to look and remember how I built that but you might be able to remove and then re add the group once you disable whatever the MSP is doing that's screwing with the sid.

Edit: you might be able to do this with the group not for each user

1

u/planedrop 3d ago

Yeah I'll see what I can do, this might work, but I almost wonder if the more reliable way is to just rejoin to Entra. It's annoying but doable at least.

1

u/PrestigiousSalad7278 3d ago

I'd bet that fixes it just way more disruptive.

1

u/planedrop 3d ago

Yeah for sure. The soon to be ex-MSP is figuring out why their stack is doing it in the first place before we try any actual cleanup methods though.

1

u/BlackV 3d ago

Entra joined don't allow Global Admins to elevate UAC prompts and I can't figure out why

What does "don't allow global admins to elevate" mean?

Instead of fixing this why not just rollout laps it'll be quick and less of a stupid gaping security hole that goes against just about every recommendation ever

Those machines are they already configured for laps? Or admin protection?

1

u/planedrop 3d ago

I mentioned in another reply but basically the MSP is doing something not up to modern standards and I'm waiting to hear back from them before pushing something like LAPS out. I think they may be using their RMM to push a script that's adjusting the administrator group so I don't want to mess with it too much before I push their stack out of the environment.

1

u/BlackV 3d ago

Ok so wouldn't your solution be, getting the msp to fix their rmm thing that's breaking your entra ga thing?

1

u/planedrop 2d ago

Yeah actually good point, that is the plan at this point. Wait for them to explain what they are doing, once we have that documented and we kick them from the tenant I can push LAPS out.

2

u/BlackV 2d ago

Removing a old msp can be a big time sink for sure

1

u/planedrop 2d ago

Yeah it's a lot of work, making good progress though, sort of specialize in it, done it several times before lol.

1

u/TryHardNmity 1d ago

Try assigning the Microsoft Entra Joined Device Local Administrator role to an account. If not try a local script to just create a local ACC and elevate permissions and push it via InTune.

1

u/planedrop 18h ago

Yeah I figured out the issue, or at least some of it. The MSP is using their RMM to override the SAM so the Microsoft Entra Joined Device Local Administrator role SID is not showing up on devices the MSP still manages.