Accounts Change UAC Behavior for Administrators in Windows 11


  • Staff
UAC_banner.png

This tutorial will show you how to change the User Account Control (UAC) prompt behavior for administrators in Windows 10 and Windows 11.

When User Account Control (UAC) is enabled, Windows prompts for consent or prompts for credentials of a valid local administrator account before starting a program or task that requires a full administrator access token. The UAC prompt mitigates malicious software running under elevated credentials without the user or administrator being aware of its activity.

The User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode security policy setting determines the behavior of the UAC elevation prompt for accounts that have administrative credentials.

You can select from the possible UAC behaviors below for administrators:
  • Elevate without prompting
    Assumes that the administrator will permit an operation that requires elevation, and more consent or credentials aren't required. This minimizes the protection that is provided by UAC. Microsoft doesn't recommend selecting this behavior unless administrator accounts are tightly controlled and the operating environment is highly secure.
  • Prompt for credentials on the secure desktop
    When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege.
  • Prompt for consent on the secure desktop
    When an operation requires elevation of privilege, the user is prompted on the secure desktop to select Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.
  • Prompt for credentials
    An operation that requires elevation of privilege prompts the administrator to type the user name and password. If the administrator enters valid credentials, the operation continues with the applicable privilege.
  • Prompt for consent
    An operation that requires elevation of privilege prompts the administrator to select Permit or Deny. If the administrator selects Permit, the operation continues with the administrator's highest available privilege.
  • (Default) Prompt for consent for non-Windows binaries
    This prompt for consent is the default. When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.
Reference:


You must be signed in as an administrator to change the User Account Control (UAC) prompt behavior for administrators.



Contents

  • Option One: Change UAC Behavior for Administrators in Local Security Policy
  • Option Two: Change UAC Behavior for Administrators using REG file


EXAMPLE: Default User Account Control (UAC) prompt for administrators

UAC_prompt_for_administrator.png





Option One

Change UAC Behavior for Administrators in Local Security Policy


Local Security Policy is only available in the Windows 10/11 Pro, Enterprise, and Education editions.

All editions can use Option Two to change the same policy.


1 Open Local Security Policy (secpol.msc).

2 Perform the following actions: (see screenshot below)
  1. Expand open the Local Policies folder in the left pane.
  2. Click/tap on the Security Options subfolder in the left pane.
  3. Double click/tap on the User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode policy in the right pane.
UAC_prompt_for_administrators-1.png

3 In the Local Security Setting tab, select the UAC behavior you want for administrators in the drop menu, and click/tap on OK. (see screenshot below)

UAC_prompt_for_administrators-2.png

4 You can now close Local Security Policy if you like.




Option Two

Change UAC Behavior for Administrators using REG file


1 Do the step below for the UAC behavior you want for administrators:
2 Change UAC Behavior for Administrators to "Elevate without prompting"

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

Administrators_UAC_Elevate_without_prompting.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000000

3 Change UAC Behavior for Administrators to "Prompt for credentials on the secure desktop"

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

Administrators_UAC_Prompt_for_credentials_on_secure_desktop.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000001

4 Change UAC Behavior for Administrators to "Prompt for consent on the secure desktop"

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

Administrators_UAC_Prompt_for_consent_on_secure_desktop.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000002

5 Change UAC Behavior for Administrators to "Prompt for credentials"

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

Administrators_UAC_Prompt_for_credentials.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000003

6 Change UAC Behavior for Administrators to "Prompt for consent"

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

Administrators_UAC_Prompt_for_consent.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000004

7 Change UAC Behavior for Administrators to "Prompt for consent for non-Windows binaries"

This is the default setting.


A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

Default_Administrators_UAC_Prompt_for_consent_for_non-Windows_binaries.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005

8 Save the .reg file to your desktop.

9 Double click/tap on the downloaded .reg file to merge it.

10 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

11 You can now delete the downloaded .reg file if you like.


That's it,
Shawn Brink


 

Attachments

  • UAC.png
    UAC.png
    7.9 KB · Views: 47
  • Administrators_UAC_Elevate_without_prompting.reg
    660 bytes · Views: 57
  • Administrators_UAC_Prompt_for_consent.reg
    656 bytes · Views: 73
  • Administrators_UAC_Prompt_for_consent_on_secure_desktop.reg
    656 bytes · Views: 61
  • Administrators_UAC_Prompt_for_credentials.reg
    660 bytes · Views: 60
  • Administrators_UAC_Prompt_for_credentials_on_secure_desktop.reg
    656 bytes · Views: 63
  • Default_Administrators_UAC_Prompt_for_consent_for_non-Windows_binaries.reg
    652 bytes · Views: 62
Last edited:

Latest Support Threads

Back
Top Bottom