Microsoft introduced the User Account Control (UAC) in Windows Vista and Windows Server 2008 to block activities requiring administrative privileges on Windows systems until an administrator permits them.
The company relaxed the feature in Windows 7 and Server 2008 R2 to make it less annoying for users.
A simple example of UAC kicking in on Windows 10 is the launching of the system's Registry Editor. Windows displays an UAC prompt whenever you open the editor on the system.
This prompt is fullscreen by default blocking everything else that is happening on the screen until the user responds to the prompt by allowing or preventing the action.
These prompts may or may not be annoying depending on how often they spawn on the system. If you work regularly with system applications or install new desktop programs regularly on Windows systems, you may want to relax the User Account Control settings to make UAC as a whole less intrusive.
The method described below will disable the "dimming" of the screen until the User Account Control prompt is answered but won't modify the feature in any other way.
This means basically that the prompt is displayed just like any other window on the screen and not exclusively on it.
The controls to do so are identical to those of previous versions of the Windows operating system. The guide may be useful to new users and users who forgot about them.
- Tap on the Windows-key to open the Start Menu.
- Type control panel and hit enter.
- Select User Accounts on the window that opens.
- Select User Accounts on the next window as well.
- Click on "Change User Account Control" settings on the next.
- Move the slider from "notify me only when apps try to make changes to my computer (default)" to "notify me only when apps try to make changes to my computer (do not dim my desktop)" and click ok afterwards.
- This spawns a User Account Control prompt that you need to accept.
The changes take effect immediately. If you want to test them, try running the Registry Editor on the system. You should get a regular UAC prompt instead of an exclusive prompt now.
You may modify the User Account Control behavior further by modifying local security policies or Registry preferences.
- Tap on the Windows-key, type secpol.msc and hit enter. This opens the Local Security Policy.
- Navigate to Security Settings > Local Policies > Security Options.
- Scroll down until you find the User Account Control preferences. You should find 10 policies there that you can modify.
The settings are:
- Admin Approval Mode for the Built-In Administrator account
- Allow UIAccess applications to prompt for elevation without using the secure desktop
- Behavior of the elevation prompt for administrators in Admin Approval Mode
- Behavior of the elevation prompt for standard users
- Detect application installations and prompt for elevation
- Only elevate executables that are signed and validated
- Only elevate UIAccess applications that are installed in secure locations
- Run all administrators in Admin Approval Mode
- Switch to the secure desktop when prompting for elevation
- Virtualize file and registry write failures to per-user locations.
Detailed information about each policy are posted on Microsoft's Technet website.
No 6 looks like an excellent antimalware setting, leave on unless installing stuff ?
Allow me to clarify something. Regedit is a poor example. Standard users CAN open Regedit. Just hit Win + r, type "regedit" (without the quotes) and hit Enter. Regedit will open and the screen DOES NOT dim. Furthermore, Standard users are allowed to make changes to HKEY_CURRENT_USER without administrative privileges. Of course, if a Standard user wants to make changes to other parts of the Registry he would need administrative privileges and THAT is when the screen gets dimmed.
The secure desktop is used to isolate the prompts. Otherwise, malware would easily spoof them.
IIRC, it's created by the virtual desktops API introduced in Windows NT 4.0 or 2000.
You of course properly warn everyone that running UAC at anything but its highest setting, completely negates all of the security benefits that UAC brings, right? You wouldn't leave that part out, would you? Stuff like virtualizing the registry for misbehaving legacy applications is but one of many benefits of running UAC at its highest level.
But yeah, it's just about it being "annoying."
Well done, hero. You saved the world.
I can't test it, because I took Windows Last off my test machine, but doesn't TweakUAC, which has worked on Vista, 7, and 8, still work?
When you disable UAC completely Edge browser does not start anymore. LOL
M$ has shot themselves in the foot again. No power user will use edge anymore.
No Universal App will work if you disable UAC completely, because UAC is responsible for maintaining the MIC of Integrity Levels in Windows.
You're not a power user for disabling UAC, you're a damn fool.
Is MIC a Microsoft invented word that means "illusion"?
Good to know that complete ignorance on a subject won't stop you from posting, marc. I'll be sure to keep in mind that you think the idea of "sandboxing" is merely an illusion.
Why would anyone with a modicum of intelligence choose to use a Microsoft browser. They have all been crap, in one form or another. This new one is just more of the same, except that it is also aggressively ugly. [though I hear 5 year old kids love it!]
Concerning: problem loading page/ Server not found by hyperlink.
Martin, Thanks for this great article.
A question from me to you: Do you know or the referral hyperlink that you are giving at the end (Detailed information about each policy are posted on Microsoft's Technet website.) of your excellent article, is not coming up because of a down website or that the hyperlink () is not correct?
Link was wrong Paulus, sorry for that. I have replaced it with the correct one.
Thanks Martin, For taking the effort to replace the dead/not working/wrong link for a perfectly fine working one.
TweakUAC works still on W10
Is there a way to get Windows 10 to stop sending me the "Upgrade to Microsoft Office" notifications? I seem to get it every week.
Uninstall the "Get Office" app.
Wow. I didn't realize it was even an app.
Thanks!