My Windows 11 machine is company owned and enrolled in Intune. Join type is "Microsoft entra joined". I am logged in with my EntraID account. The account is not a member of local "Administrators" group, instead it is a member only of the following local groups: "Network Configuration Operators", "Hyper-V Administrators" and "Users". The Intune policy prevents me from turning off UAC elevation and that is how it is supposed to be.

What am I trying to achieve? I have to be able to modify the configuration of network interfaces without local administrator privileges but as a member of mentioned local groups. Using Powershell cmdlet New-NetIPAddress I get "New-NetIPAddress: Access is denied." error which is understandable and expected. Is there a way to bypass this?

My Windows 11 machine is company owned and enrolled in Intune. Join type is "Microsoft entra joined". I am logged in with my EntraID account. The account is not a member of local "Administrators" group, instead it is a member only of the following local groups: "Network Configuration Operators", "Hyper-V Administrators" and "Users". The Intune policy prevents me from turning off UAC elevation and that is how it is supposed to be.

What am I trying to achieve? I have to be able to modify the configuration of network interfaces without local administrator privileges but as a member of mentioned local groups. Using Powershell cmdlet New-NetIPAddress I get "New-NetIPAddress: Access is denied." error which is understandable and expected. Is there a way to bypass this?

• uac
• administrator
• network-interface
• bypass

1 Answer 1

There's no bypass required here. Network Configuration Operators is one of the groups which are disabled on MediumIL tokens. You should be able to see this yourself by using whoami /groups in cmd. Network Configuration Operators will be listed as having the attribute "Group used for deny only".

In order to fix your problem, you should only need to answer a UAC prompt with your own credentials.