Remote UAC

UAC enables users to perform common day-to-day tasks as non-administrators. User accounts that are members of the local Administrators group will run most applications by using the principle of least privilege.

How UAC remote restrictions work

To better protect those users who are members of the local Administrators group, microsoft implement UAC restrictions. This mechanism helps prevent you preforming tasks remotely with a local user account, for example, lateral movement using the IPC$ share.

Local user accounts (Security Account Manager user account)

When a user who is a member of the local Administrators group on the target remote computer establishes a remote administrative connection by using the net use *\remotecomputer\Share$ command, for example, they won’t connect as a full administrator. The user has no elevation potential on the remote computer, and the user cannot perform administrative tasks. If the user wants to administer the workstation with a Security Account Manager (SAM) account, the user must interactively log on to the computer that is to be administered with Remote Assistance or Remote Desktop, if these services are available.

Domain users with administrator rights are exempt from remote UAC.

Disable Remote UAC

If the target has RDP enabled (and you are able to RDP) you can use the following regkey to disable Remote UAC.

Enable

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

Disable

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 0 /f