This tutorial will show you how to enable or disable requiring users to press Ctrl+Alt+Delete when prompted by User Account Control (UAC) to approve or enter credentials on the dimmed Secure Desktop.
When User Account Control (UAC) is enabled, Windows prompts for consent or prompts for credentials of a valid local administrator account before starting a program or task that requires a full administrator access token. The UAC prompt mitigates malicious software running under elevated credentials without the user or administrator being aware of its activity.
The Require Trusted Path for Credential Entry policy is a security setting in Windows that mandates users to enter their credentials using a trusted path. This is designed to prevent malicious software, such as Trojan horses, from capturing user credentials. When this policy is enabled, users must enter their credentials on the Secure Desktop, which is a special mode that isolates the credential entry process from other running applications.
When the Require Trusted Path for Credential Entry policy is enabled users must click/tap on OK for the authentic Windows sign-in screen (dimmed Secure Desktop) and then press Ctrl+Alt+Delete to approve or enter credentials when prompted by User Account Control (UAC).
References:
How User Account Control works
Learn about User Account Control (UAC) components and how it interacts with the end users.
learn.microsoft.com
Asking for clear written documentation that "Require trusted path for credential entry" is no longer recommended - The Old New Thing
It was never recommended in the first place.
devblogs.microsoft.com
You must be signed in as an administrator to enable or disable User Account Control (UAC) prompts to show on the Secure Desktop after pressing Ctrl+Alt+Delete.
Contents
- Option One: Enable or Disable UAC Prompt on Ctrl+Alt+Delete Secure Desktop in Local Group Policy Editor
- Option Two: Enable or Disable UAC Prompt on Ctrl+Alt+Delete Secure Desktop using REG file
EXAMPLE: Enable requiring Ctrl+Alt+Delete for UAC prompt on Secure Desktop
Enable or Disable UAC Prompt on Ctrl+Alt+Delete Secure Desktop in Local Group Policy Editor
The Local Group Policy Editor is only available in the Windows 10/11 Pro, Enterprise, and Education editions.
All editions can use Option Two to configure the same policy.
1 Open the Local Group Policy Editor (gpedit.msc).
2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below step 3)
Computer Configuration > Administrative Templates > Windows Components > Credential User Interface
3 In the right pane of Credential User Interface in the Local Group Policy Editor, double click/tap on the Require trusted path for credential entry policy to edit it. (see screenshot below)
4 Do step 5 (enable) or step 6 (disable) below for what you want.
5 Enable UAC Prompt on Ctrl+Alt+Delete Secure Desktop
A) Select (dot) Enabled. (see screenshot below)
B) Click/tap on OK, and go to step 7 below.
6 Disable UAC Prompt on Ctrl+Alt+Delete Secure Desktop
This is the default setting.
A) Select (dot) Not Configured. (see screenshot below)
B) Click/tap on OK, and go to step 7 below.
7 You can now close the Local Group Policy Editor if you like.
1 Do step 2 (enable) or step 3 (disable) below for what you want.
2 Enable UAC Prompt on Ctrl+Alt+Delete Secure Desktop
A) Click/tap on the Download button below to download the file below, and go to step 4 below.
Enable_UAC_prompt_on_Ctrl+Alt+Del_Secure_Desktop.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI]
"EnableSecureCredentialPrompting"=-3 Disable UAC Prompt on Ctrl+Alt+Delete Secure Desktop
This is the default setting.
A) Click/tap on the Download button below to download the file below, and go to step 4 below.
Disable_UAC_prompt_on_Ctrl+Alt+Del_Secure_Desktop.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI]
"EnableSecureCredentialPrompting"=dword:000000014 Save the .reg file to your desktop.
5 If you have Smart App Control turned on, you will need to unblock the downloaded REG file.
6 Double click/tap on the downloaded .reg file to merge it.
7 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
8 You can now delete the downloaded .reg file if you like.
That's it,
Shawn Brink
Related Tutorials
- Change User Account Control (UAC) Settings in Windows 11
- Enable or Disable UAC for Built-in Administrator in Windows 11
- Change UAC Behavior for Standard Users in Windows 11
- Change UAC Behavior for Administrators in Windows 11
- Enable or Disable Show Administrators in UAC prompt for Standard Users in Windows 11
Last edited:
