User Account Control¶
UAC is what makes an administrator's session run as a standard user until something needs elevation, and shows a prompt when it does. Malware wants it off so that anything the user runs gets full control silently.
Where it is¶
Two places show the same thing:
- Control Panel → User Accounts → Change User Account Control settings (the slider)
secpol.msc→ Local Policies → Security Options → the entries starting with User Account Control
The slider should be at the top or one notch below. The policy entries are more precise.
The settings¶
| Setting | Set to | Why |
|---|---|---|
| User Account Control: Run all administrators in Admin Approval Mode (2.3.17.6) | Enabled | This is the master switch. Disabled means UAC is off. |
| User Account Control: Admin Approval Mode for the Built-in Administrator account (2.3.17.1) | Enabled | Otherwise the built-in Administrator never sees a prompt |
| User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode (2.3.17.2) | Prompt for consent on the secure desktop | The "secure desktop" dims the screen and can't be faked by a program |
| User Account Control: Behavior of the elevation prompt for standard users (2.3.17.3) | Automatically deny elevation requests | Standard users can't elevate at all; an administrator has to log in to do admin work. ("Prompt for credentials on the secure desktop" is the acceptable alternative if the scenario needs users to run installers with an admin password.) |
| User Account Control: Switch to the secure desktop when prompting for elevation (2.3.17.7) | Enabled | |
| User Account Control: Only elevate UIAccess applications that are installed in secure locations (2.3.17.5) | Enabled | Stops a program in a user folder from getting UI automation privileges |
| User Account Control: Detect application installations and prompt for elevation (2.3.17.4) | Enabled | Installers trigger a prompt |
| User Account Control: Virtualize file and registry write failures to per-user locations (2.3.17.8) | Enabled | Compatibility; leave on |
"Prompt for credentials on the secure desktop" is also acceptable for administrators and is slightly stricter.
Step by step¶
secpol.msc→ Local Policies → Security Options.- Scroll to the bottom; the User Account Control entries are last.
- Set each row in the table.
- Open the Control Panel slider and confirm it moved to the top or second notch.
Verify¶
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin=4,2
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths=4,1
EnableLUA=4,0 means UAC is entirely off. ConsentPromptBehaviorAdmin of 1 or 2 is right; 0 means elevate silently.
One more, in Group Policy¶
gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Credential User Interface → Enumerate administrator accounts on elevation (18.10.15.2): Disabled. Otherwise every UAC prompt lists the administrator account names for anyone looking over a shoulder.
Example¶
Running a program on the image never shows a UAC prompt. reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA returns 0. Set Run all administrators in Admin Approval Mode to Enabled, restart, and the prompts return.