This tutorial will show you how to change the User Account Control (UAC) prompt behavior only for standard users in Windows 10 and Windows 11.
When User Account Control (UAC) is enabled, Windows prompts for consent or prompts for credentials of a valid local administrator account before starting a program or task that requires a full administrator access token. The UAC prompt mitigates malicious software running under elevated credentials without the user or administrator being aware of its activity.
The User Account Control: Behavior of the elevation prompt for standard users security policy setting determines the behavior of the elevation prompt for standard users. You can select one of the UAC prompt behaviors below to be used for standard users:
- Automatically deny elevation requests
This option returns an Access denied error message to standard users when they try to perform an operation that requires elevation of privilege. - Prompt for credentials on the secure desktop
When an operation requires elevation of privilege, the user is prompted on the secure desktop (dimmed) to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - Prompt for credentials (default)
An operation that requires elevation of privilege prompts the user to type an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
Behavior of the elevation prompt for standard users - Windows 10
Learn about best practices, security considerations, and more for the policy setting, User Account Control Behavior of the elevation prompt for standard users.
learn.microsoft.com
You must be signed in as an administrator to change the User Account Control (UAC) prompt behavior for standard users.
Contents
- Option One: Change UAC Behavior for Standard Users in Local Security Policy
- Option Two: Change UAC Behavior for Standard Users using REG file
EXAMPLE: Default User Account Control (UAC) prompt for standard users
Local Security Policy is only available in the Windows 10/11 Pro, Enterprise, and Education editions.
All editions can use Option Two to change the same policy.
1 Open Local Security Policy (secpol.msc).
2 Perform the following actions: (see screenshot below)
- Expand open the Local Policies folder in the left pane.
- Click/tap on the Security Options subfolder in the left pane.
- Double click/tap on the User Account Control: Behavior of the elevation prompt for standard users policy in the right pane.
3 In the Local Security Setting tab, select (dot) Automatically deny elevation requests, Prompt for credentials on the secure desktop, or Prompt for credentials (default) for what you want in the drop menu, and click/tap on OK. (see screenshot below)
4 You can now close Local Security Policy if you like.
1 Do step 2 (Automatically deny), step 3 (Prompt for credentials on secure desktop), or step 4 (Default - Prompt for credentials) below for what you want.
2 Change UAC Behavior for Standard Users to "Automatically deny elevation requests"
A) Click/tap on the Download button below to download the file below, and go to step 5 below.
Standard_users_UAC_Automatically_deny_elevation_requests.reg
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=dword:000000003 Change UAC Behavior for Standard Users to "Prompt for credentials on the secure desktop"
A) Click/tap on the Download button below to download the file below, and go to step 5 below.
Standard_users_UAC_prompt_for_administrator_credentials_on_secure_desktop.reg
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=dword:000000014 Change UAC Behavior for Standard Users to "Prompt for credentials"
This is the default setting.
A) Click/tap on the Download button below to download the file below, and go to step 5 below.
Default_standard_users_UAC_prompt_for_administrator_credentials.reg
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=dword:000000035 Save the .reg file to your desktop.
6 Double click/tap on the downloaded .reg file to merge it.
7 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
8 You can now delete the downloaded .reg file if you like.
That's it,
Shawn Brink
Attachments
Last edited:
