How to Disable or Change User Account Control (UAC) Settings in Windows

User Account Control (UAC) is a default Windows security feature designed to prevent unwanted changes to the operating system. When a program tries to perform an action that requires administrator privileges, such as installing software or changing system settings, registry, or system files, UAC alerts the administrator and asks for confirmation. This reduces the risk of unauthorized changes and the execution of malicious code with administrator privileges.

In this article, we’ll look at how to manage UAC settings on a single computer, or multiple computers in a domain using Group Policies.

What does the UAC prompt look like? For example, if you attempt to elevate process privileges in a local administrator session, a UAC confirmation prompt appears:

User Account Control
Do you want to allow this app to make changes to your device?

Configure User Account Control (UAC) Levels in Windows

To manage UAC settings in Windows, a special applet is available in the Control Panel, which can be launched from the classic Control Panel or with the UserAccountControlSettings.exe command.

Use the slider to change the User Account Control protection level on a computer. There are 4 predefined UAC levels available:

• Level 4 — Always notify — the highest UAC protection level;
• Level 3 — Notify only when programs try to make changes to my computer (default) – default protection level (used by default);
• Level 2 — Notify only when programs try to make changes to my computer (do not dim my desktop) – almost the same as the previous level, but without switching to Secure Desktop with desktop locking;
• Level 1 — Never notify – UAC is disabled.

Note that moving the slider to the bottom Never notify (Level 1) position doesn’t completely disable UAC. This mode only enables automatic confirmation of administrator elevation requests without displaying the UAC prompt. Elevation requests are automatically denied in non-admin user sessions.

To disable UAC completely, you must disable the local group policy option User Account Control: Run all administrators in Admin Approval Mode. See below for details.

Managing UAC Settings via Group Policy

It is possible to manage UAC settings in Windows through Group Policy. The names of the UAC-related Group Policy options begin with User Account Control and can be found in this GPO editor section Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options.

The following table contains a list of UAC policies, their possible values (including defaults), and the corresponding registry parameters (located under the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System registry key).

User Account Control Slider Levels and GPO/Registry Settings

When you change the UAC protection level by using the slider in the Control Panel, Windows changes the values of the following registry entries.

Therefore, if you want to use the GPO to configure UAC settings that correspond to the specific slider level, you only need to configure 3 policy parameters (described above).

For example, apply the following registry parameters to set UAC level 3:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"PromptOnSecureDesktop"=dword:00000001
"EnableLUA"=dword:00000001
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"EnableInstallerDetection"=dword:00000001
"EnableVirtualization"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"FilterAdministratorToken"=dword:00000000

The values of the ConsentPromptBehaviorUser, EnableInstallerDetection, EnableVirtualization, ValidateAdminCodeSignatures, and FilterAdministratorToken parameters are the same for all levels.

How to Disable UAC with Group Policy

Let’s look at how to completely disable User Account Control (UAC) in Windows through Group Policy.

On a standalone computer, use the Local Group Policy Editor gpedit.msc. If you need to deploy the Group Policy settings to multiple domain computers, use the Group Policy Management Console – gpmc.msc (let’s consider this option).

1. In the Group Policy Management snap-in, click the OU containing computers where you want to disable UAC and create a new GPO
2. Edit the policy and go to the section Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options;
3. To completely disable UAC, set the following parameter values:
   • User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode = Elevate without prompting;
   • User Account Control: Detect application installations and prompt for elevation = Disabled;
   • User Account Control: Run all administrators in Admin Approval Mode = Disabled;
   • User Account Control: Only elevate UIAccess applications that are installed in secure locations = Disabled.
4. Reboot the target computers to update Group Policy settings and disable UAC. After the reboot, UAC will switch to “Never notify” mode.

You can also disable UAC for some users/computers via the registry and deploy the settings through Group Policy Preferences.

In the GPO editor, go to Computer Configuration -> Preferences -> Windows Settings -> Registry and create a new registry parameter with the following settings

• Action: Replace
• Hive: HKEY_LOCAL_MACHINE
• Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
• Value name: EnableLUA
• Value type: REG_DWORD
• Value data: 0

Then go to the Common tab and enable the options:

• Remove this item when it is no longer applied
• Item-Level targeting

Click the Targeting button and specify the computers or domain security groups to which you want to apply the UAC disable policy.

You can change the value of any parameter using the Registry Editor GUI or from the command prompt. For example, to disable UAC on a computer (a reboot is required), run the command:

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f.

Or a similar PowerShell command:

New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force