User Account Control¶

UAC is what makes an administrator's session run as a standard user until something needs elevation, and shows a prompt when it does. Malware wants it off so that anything the user runs gets full control silently.

Where it is¶

Two places show the same thing:

Control Panel → User Accounts → Change User Account Control settings (the slider)
secpol.msc → Local Policies → Security Options → the entries starting with User Account Control

The slider should be at the top or one notch below. The policy entries are more precise.

The settings¶

Setting	Set to	Why
User Account Control: Run all administrators in Admin Approval Mode (2.3.17.6)	Enabled	This is the master switch. Disabled means UAC is off.
User Account Control: Admin Approval Mode for the Built-in Administrator account (2.3.17.1)	Enabled	Otherwise the built-in Administrator never sees a prompt
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode (2.3.17.2)	Prompt for consent on the secure desktop	The "secure desktop" dims the screen and can't be faked by a program
User Account Control: Behavior of the elevation prompt for standard users (2.3.17.3)	Automatically deny elevation requests	Standard users can't elevate at all; an administrator has to log in to do admin work. ("Prompt for credentials on the secure desktop" is the acceptable alternative if the scenario needs users to run installers with an admin password.)
User Account Control: Switch to the secure desktop when prompting for elevation (2.3.17.7)	Enabled
User Account Control: Only elevate UIAccess applications that are installed in secure locations (2.3.17.5)	Enabled	Stops a program in a user folder from getting UI automation privileges
User Account Control: Detect application installations and prompt for elevation (2.3.17.4)	Enabled	Installers trigger a prompt
User Account Control: Virtualize file and registry write failures to per-user locations (2.3.17.8)	Enabled	Compatibility; leave on

"Prompt for credentials on the secure desktop" is also acceptable for administrators and is slightly stricter.

Step by step¶

secpol.msc → Local Policies → Security Options.
Scroll to the bottom; the User Account Control entries are last.
Set each row in the table.
Open the Control Panel slider and confirm it moved to the top or second notch.

Verify¶

MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin=4,2
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths=4,1

EnableLUA=4,0 means UAC is entirely off. ConsentPromptBehaviorAdmin of 1 or 2 is right; 0 means elevate silently.

One more, in Group Policy¶

gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Credential User Interface → Enumerate administrator accounts on elevation (18.10.15.2): Disabled. Otherwise every UAC prompt lists the administrator account names for anyone looking over a shoulder.

Example¶

Running a program on the image never shows a UAC prompt. reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA returns 0. Set Run all administrators in Admin Approval Mode to Enabled, restart, and the prompts return.

Try it¶

Set UAC to the highest level and start cmd as administrator: what does the prompt look like? Then set 'Behavior of the elevation prompt for standard users' to automatically deny and try again as a standard user.
Find every UAC setting in secpol.msc and its registry value.

Build it¶

A uac.bat with the seven reg add lines under Policies\System and a reg query of the same key after.

Next¶

Logon Screen and Shutdown