This tutorial will show you how to change the User Account Control (UAC) prompt behavior for administrators in Windows 10 and Windows 11.
When User Account Control (UAC) is enabled, Windows prompts for consent or prompts for credentials of a valid local administrator account before starting a program or task that requires a full administrator access token. The UAC prompt mitigates malicious software running under elevated credentials without the user or administrator being aware of its activity.
The User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode security policy setting determines the behavior of the UAC elevation prompt for accounts that have administrative credentials.
You can select from the possible UAC behaviors below for administrators:
- Elevate without prompting
Assumes that the administrator will permit an operation that requires elevation, and more consent or credentials aren't required. This minimizes the protection that is provided by UAC. Microsoft doesn't recommend selecting this behavior unless administrator accounts are tightly controlled and the operating environment is highly secure. - Prompt for credentials on the secure desktop
When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - Prompt for consent on the secure desktop
When an operation requires elevation of privilege, the user is prompted on the secure desktop to select Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for credentials
An operation that requires elevation of privilege prompts the administrator to type the user name and password. If the administrator enters valid credentials, the operation continues with the applicable privilege. - Prompt for consent
An operation that requires elevation of privilege prompts the administrator to select Permit or Deny. If the administrator selects Permit, the operation continues with the administrator's highest available privilege. - (Default) Prompt for consent for non-Windows binaries
This prompt for consent is the default. When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.
User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode - Windows 10
Best practices and more for the security policy setting, User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode.
learn.microsoft.com
You must be signed in as an administrator to change the User Account Control (UAC) prompt behavior for administrators.
Contents
- Option One: Change UAC Behavior for Administrators in Local Security Policy
- Option Two: Change UAC Behavior for Administrators using REG file
EXAMPLE: Default User Account Control (UAC) prompt for administrators
Local Security Policy is only available in the Windows 10/11 Pro, Enterprise, and Education editions.
All editions can use Option Two to change the same policy.
1 Open Local Security Policy (secpol.msc).
2 Perform the following actions: (see screenshot below)
- Expand open the Local Policies folder in the left pane.
- Click/tap on the Security Options subfolder in the left pane.
- Double click/tap on the User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode policy in the right pane.
3 In the Local Security Setting tab, select the UAC behavior you want for administrators in the drop menu, and click/tap on OK. (see screenshot below)
4 You can now close Local Security Policy if you like.
1 Do the step below for the UAC behavior you want for administrators:
- Step 2: Elevate without prompting
- Step 3: Prompt for credentials on the secure desktop
- Step 4: Prompt for consent on the secure desktop
- Step 5: Prompt for credentials
- Step 6: Prompt for consent
- Step 7: (Default) Prompt for consent for non-Windows binaries
2 Change UAC Behavior for Administrators to "Elevate without prompting"
A) Click/tap on the Download button below to download the file below, and go to step 8 below.
Administrators_UAC_Elevate_without_prompting.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:000000003 Change UAC Behavior for Administrators to "Prompt for credentials on the secure desktop"
A) Click/tap on the Download button below to download the file below, and go to step 8 below.
Administrators_UAC_Prompt_for_credentials_on_secure_desktop.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:000000014 Change UAC Behavior for Administrators to "Prompt for consent on the secure desktop"
A) Click/tap on the Download button below to download the file below, and go to step 8 below.
Administrators_UAC_Prompt_for_consent_on_secure_desktop.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:000000025 Change UAC Behavior for Administrators to "Prompt for credentials"
A) Click/tap on the Download button below to download the file below, and go to step 8 below.
Administrators_UAC_Prompt_for_credentials.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:000000036 Change UAC Behavior for Administrators to "Prompt for consent"
A) Click/tap on the Download button below to download the file below, and go to step 8 below.
Administrators_UAC_Prompt_for_consent.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:000000047 Change UAC Behavior for Administrators to "Prompt for consent for non-Windows binaries"
This is the default setting.
A) Click/tap on the Download button below to download the file below, and go to step 8 below.
Default_Administrators_UAC_Prompt_for_consent_for_non-Windows_binaries.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:000000058 Save the .reg file to your desktop.
9 Double click/tap on the downloaded .reg file to merge it.
10 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
11 You can now delete the downloaded .reg file if you like.
That's it,
Shawn Brink
Last edited:
