>Anyway, this discussion started as a thread about mapping sudo to either
>InteractiveLogonRight or RemoteLogonRight. It sounds to me that
>Michichael and Simo are for moving sudo to the Remote bucked. Is that
>right?
Negative - we're for removing it from GPO checks entirely.
> Isn't the use of RunAs/UAC on Windows similar to sudo (in that they are used for privilege escalation)?
Yes and no - When you RunAs it checks the target account for Local InteractiveLogon - if you try to RunAs an account that is denied Local InteractiveLogon it'll fail (even if you can remotely log into that account and execute the task as that account). Sudoers is closer to creating process tokens and act as operating system since it does impersonation. RunAs isn't impersonation, it's a secondary logon. UAC does impersonation for admin tokens, but not with the ruleset that sudo has. That's why it's so muddy.
>It's not clear to me which option you are suggesting?
My position is option B. An account with only RemoteInteractiveLogon and/or Denied Local InteractiveLogon should still be able to authenticate against sudo and use its functionality.