How do I change the behavior of the User Account Control message?

You can use the accounts manager settings to disable User Account Control (UAC) completely. In addition, in Windows Vista™ Enterprise and Windows Vista Ultimate an administrator can change the behavior of the User Account Control message for standard users or for local administrators in Admin Approval Mode.

Examples of situations where you might want to do so include:

  • Environments where all applications must be pre-approved and installed centrally.

  • Organizations that must comply with Common Criteria standards or corporate policies that require credentials be used for all administrator tasks.

Disable or enable User Account Control

Use the following procedure to disable or enable UAC.

To perform the following procedure, you must be able to log on with or provide the credentials of a member of the local Administrators group.

To disable or enable UAC

  1. Click Start, and then click Control Panel.

  2. In Control Panel, click User Accounts.

  3. In the User Accounts window, click User Accounts.

  4. In the User Accounts tasks window, click Turn User Account Control on or off.

  5. If UAC is currently configured in Admin Approval Mode, the User Account Control message appears. Click Continue.

  6. Do one of the following:

    • To disable UAC, clear the Use User Account Control (UAC) to help protect your computer check box.

    • To enable UAC, select the Use User Account Control (UAC) to help protect your computer check box.

  7. Click OK.

  8. Click Restart Now to apply the change right away, or click Restart Later and close the User Accounts tasks window.

Change the behavior of the User Account Control message for administrators in Admin Approval Mode

Use the following procedure to change the User Account Control message behavior for administrators.

To perform the following procedure, you must be using Windows Vista Enterprise or Windows Vista Ultimate, and you must be able to log on with or provide the credentials of a member of the local Administrators group.

To change the behavior of the User Account Control message for administrators in Admin Approval Mode

  1. Click Start, click All Programs, click Accessories, click Run, type secpol.msc in the Open box, and then click OK.

  2. If UAC is currently configured in Admin Approval Mode, the User Account Control message will appear. Click Continue.

  3. From the Local Security Policy tree, click Local Policies, and then double-click Security Options.

  4. Scroll down to and double-click User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode.

  5. From the drop-down menu, select one of the following settings:

  6. Elevate without prompting

    In this case, applications that have been marked as administrator applications, as well as applications detected as setup applications, will automatically run with the full administrator access token. All other applications will automatically run with the standard user token.

  7. Prompt for credentials

    In this case, in order to give consent for an application to run with the full administrator access token, the user must enter administrator credentials. This setting supports compliance with Common Criteria or corporate policies.

  8. Prompt for consent

    This is the default setting.

  9. Click Apply.

Change the behavior of the User Account Control message for standard users

Use the following procedure to change the User Account Control message behavior for standard users.

To perform the following procedure, you must be using Windows Vista Enterprise or Windows Vista Ultimate, and you must be able to log on with or provide the credentials of a member of the local Administrators group.

To change the behavior of the User Account Control message for standard users

  1. Click Start, click All Programs, click Accessories, click Run, type secpol.msc in the Open text box, and then click OK.

  2. If UAC is currently configured to prompt for administrator credentials, the User Account Control message will appear. Click Continue.

  3. From the Local Security Policy tree, click Local Policies, and then double-click Security Options.

  4. Scroll down and double-click User Account Control: Behavior of the elevation prompt for standard users.

  5. From the drop-down menu, select one of the following settings:

    • Automatically deny elevation requests

      In this case, administrator applications will not be able to run. The user should see an error message from the application that indicates a policy has prevented the application from running.

    • Prompt for credentials

      This is the default setting. In this case, for an application to run with the full administrator access token, the user must enter administrator credentials.

  6. Click Apply.

Additional Resources