I want to allow certain Domain Users with local administrativ permissions to install certain software on their local computers using applocker. So I created an appropriate user group and configured Applocker that users in those group are allowed to install certain software that is configured by Applocker. I'm using GPOs. When the Domain User doubleclicks the installation file (e.g. msi) he is still prompted for administrative permissions. Is that "Works as designed" or what do I wrong?Best regards,Thomas

Which administrative permissions is he prompted for? Can he just enter his username and password? -Nick

Applocker is meant to allow or deny users to execute certain software on a system. In fact it is a better version of Software Restriction Policies that existed in Windows for a long time already.AppLocker is not meant to change the behavior of the system when an administrator tries to install software on a system. By default local administrators are allowed to run all software ona system.In its default configuration AppLocker does not change the way administrators can use the system.You expected that AppLocker would change the behavior of UAC for local administrators when installing software. This is not what AppLocker does. AppLocker has nothing to do with UAC behavior. If you need to influence UAC behavior, you can use the User Account Control policies in Group Policy.More information about AppLocker can be found at http://technet.microsoft.com/en-us/library/dd378941(WS.10).aspxRay