注册表修改非静默：如何提权运行且无UAC提示实现无人干预？

Hey there! Let's break down how to get your mic-disabling script running silently, with admin rights, and no UAC prompts across 1600+ devices via login scripts. Here are the most reliable approaches tailored to your scenario:

If your devices are joined to an Active Directory domain, this is the gold standard—no UAC hoops, built-in admin privileges, and seamless deployment:

• First, store your mic-disable script (PowerShell or batch) in the NETLOGON share on your domain controller (or a shared folder accessible to all domain computers, with read permissions for the "Domain Computers" group).
• Open the Group Policy Management Console (GPMC), create a new Group Policy Object (GPO) or edit an existing one targeting your devices/users.
• Navigate to Computer Configuration > Scripts (Startup/Shutdown) (preferred over user login scripts, since it runs as the local system account before any user logs in, avoiding delays). Alternatively, use User Configuration > Scripts (Login/Logout) if you need it tied to user sessions.
• Add your script to the startup/shutdown list. Ensure the "Run scripts visible" option is unchecked to keep it silent.
• Critical note: Startup/shutdown scripts via GPO run as the NT AUTHORITY\SYSTEM account, which has full local admin rights and bypasses UAC entirely—no user prompts, no intervention needed.

If you're not in a domain, Task Scheduler lets you run scripts with elevated rights without UAC prompts:

• First, refine your PowerShell script to target the onboard mic specifically (avoid disabling external mics). Example:

# Get and disable only the onboard microphone (adjust FriendlyName filter as needed)
$onboardMic = Get-PnpDevice -FriendlyName "*Onboard Microphone*" | Where-Object { $_.Status -eq "OK" }
if ($onboardMic) {
    Disable-PnpDevice -InputObject $onboardMic -Confirm:$false
}

• Create a task scheduler template on a test machine, then export it as XML:
  • Trigger: Set to "At log on" (for any user)
  • Action: Start powershell.exe with parameters: -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Local\Path\To\Your\Script.ps1"
  • Security options: Check "Run with highest privileges" and set the user to NT AUTHORITY\SYSTEM
  • Settings: Check "Run whether user is logged on or not" and "Hidden" to ensure silence
• Push the XML and script to target devices via your login script, then import the task with a batch command:

schtasks /create /tn "DisableOnboardMic" /xml "C:\Temp\MicDisableTask.xml" /f

We don't recommend this for most environments, but if you're in a fully controlled, closed network, you can tweak UAC to allow elevated scripts without prompts:

• Use Group Policy to navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > User Account Control: Run all administrators in Admin Approval Mode
• Set this to "Disabled"
• Warning: This lowers system security across all devices, so only use this if you have no other options.

• Test first: Run your script on a handful of devices to confirm it targets the correct mic (use Get-PnpDevice -Class AudioEndpoint -PresentOnly to list all audio devices and identify the onboard mic's InstanceId for precise targeting).
• Silence everything: For PowerShell, use -WindowStyle Hidden; for batch scripts, add @echo off at the top and append >nul 2>&1 to commands to suppress all output.

内容的提问来源于stack exchange，提问作者Bill Hart