How to disable uac

How to disable User Account Control (UAC) on Windows Server

This article introduces how to disable User Account Control (UAC) on Windows Server.

Applies to: В Windows Server 2012 R2
Original KB number: В 2526083

Summary

Under certain constrained circumstances, disabling UAC on Windows Server can be an acceptable and recommended practice. These circumstances occur only when both the following conditions are true:

If either of these conditions isn’t true, UAC should remain enabled. For example, the server enables the Remote Desktop Services role so that nonadministrative users can sign in to the server to run applications. UAC should remain enabled in this situation. Similarly, UAC should remain enabled in the following situations:

More information

UAC was designed to help Windows users move toward using standard user rights by default. UAC includes several technologies to achieve this goal. These technologies include:

File and Registry Virtualization: When a legacy application tries to write to protected areas of the file system or the registry, Windows silently and transparently redirects the access to a part of the file system or the registry that the user is allowed to change. It enables many applications that required administrative rights on earlier versions of Windows to run successfully with only standard user rights on Windows Server 2008 and later versions.

Same-desktop Elevation: When an authorized user runs and elevates a program, the resulting process is granted more powerful rights than those rights of the interactive desktop user. By combining elevation with UAC’s Filtered Token feature (see the next bullet point), administrators can run programs with standard user rights. And they can elevate only those programs that require administrative rights with the same user account. This same-user elevation feature is also known as Admin Approval Mode. Programs can also be started with elevated rights by using a different user account so that an administrator can perform administrative tasks on a standard user’s desktop.

Filtered Token: When a user with administrative or other powerful privileges or group memberships logs on, Windows creates two access tokens to represent the user account. The unfiltered token has all the user’s group memberships and privileges. The filtered token represents the user with the equivalent of standard user rights. By default, this filtered token is used to run the user’s programs. The unfiltered token is associated only with elevated programs. An account is called a Protected Administrator account under the following conditions:

User Interface Privilege Isolation (UIPI): UIPI prevents a lower-privileged program from controlling the higher-privileged process through the following way:
В В В Sending window messages, such as synthetic mouse or keyboard events, to a window that belongs to a higher-privileged process

Protected Mode Internet Explorer (PMIE): PMIE is a defense-in-depth feature. Windows Internet Explorer operates in low-privileged Protected Mode, and can’t write to most areas of the file system or the registry. By default, Protected Mode is enabled when a user browses sites in the Internet or Restricted Sites zones. PMIE makes it more difficult for malware that infects a running instance of Internet Explorer to change the user’s settings. For example, it configures itself to start every time the user logs on. PMIE isn’t actually part of UAC. But it depends on UAC features, such as UIPI.

Installer Detection: When a new process is about to be started without administrative rights, Windows applies heuristics to determine whether the new process is likely to be a legacy installation program. Windows assumes that legacy installation programs are likely to fail without administrative rights. So, Windows proactively prompts the interactive user for elevation. If the user doesn’t have administrative credentials, the user can’t run the program.

If you disable the User Account Control: Run all administrators in Admin Approval Mode policy setting. It disables all the UAC features described in this section. This policy setting is available through the computer’s Local Security Policy, Security Settings, Local Policies, and then Security Options. Legacy applications that have standard user rights that expect to write to protected folders or registry keys will fail. Filtered tokens aren’t created. And all programs run with the full rights of the user who is logged on to the computer. It includes Internet Explorer, because Protected Mode is disabled for all security zones.

One of the common misconceptions about UAC and Same-desktop Elevation in particular is: it prevents malware from being installed, or from gaining administrative rights. First, malware can be written not to require administrative rights. And malware can be written to write just to areas in the user’s profile. More important, Same-desktop Elevation in UAC isn’t a security boundary. It can be hijacked by unprivileged software that runs on the same desktop. Same-desktop Elevation should be considered a convenience feature. From a security perspective, Protected Administrator should be considered the equivalent of Administrator. By contrast, using Fast User Switching to sign in to a different session by using an administrator account involves a security boundary between the administrator account and the standard user session.

For a Windows-based server on which the sole reason for interactive logon is to administer the system, the goal of fewer elevation prompts isn’t feasible or desirable. System administrative tools legitimately require administrative rights. When all the administrative user’s tasks require administrative rights, and each task could trigger an elevation prompt, the prompts are only a hindrance to productivity. In this context, such prompts don’t/can’t promote the goal of encouraging development of applications that require standard user rights. Such prompts don’t improve the security posture. These prompts just encourage users to click through dialog boxes without reading them.

This guidance applies only to well-managed servers. It means only administrative users can log on interactively or through Remote Desktop services. And they can perform only legitimate administrative functions. The server should be considered equivalent to a client system in the following situations:

In this case, UAC should remain enabled as a defense-in-depth measure.

Also, if standard users sign in to the server at the console or through Remote Desktop services to run applications, especially web browsers, UAC should remain enabled to support file and registry virtualization and also Protected Mode Internet Explorer.

Another option to avoid elevation prompts without disabling UAC is to set the User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode security policy to Elevate without prompting. By using this setting, elevation requests are silently approved if the user is a member of the Administrators group. This option also leaves PMIE and other UAC features enabled. However, not all operations that require administrative rights request elevation. Using this setting can result in some of the user’s programs being elevated and some not, without any way to distinguish between them. For example, most console utilities that require administrative rights expect to be started at a command prompt or other program that’s already elevated. Such utilities merely fail when they’re started at a command prompt that isn’t elevated.

How to Disable UAC in Windows 10? Here Are Four Simple Ways! [MiniTool Tips]

Although disabling UAC is a terrible idea, this move is necessary if UAC prevents some applications from running properly. MiniTool will show you how to disable UAC Windows 10. Additionally, some tips on how to change UAC for standard user to automatically deny UAC elevation requests are also introduced simply.

What Is UAC in Windows 10

UAC, short for User Account Control, is a component of Microsoft Windows’s security system. It can help mitigate the impact of malware by preventing apps from making unwanted changes on the PC.

Windows 10 will pop up a UAC confirmation dialog to ask you to confirm the change or not when some software attempts to change system-related parts of the file system or Windows Registry. Simply put, UAC can offer a special security environment, which protects your user account that has limited access rights well.

However, turning UAC on sometimes prevents programs from running well. Then, a solution is to disable UAC in Windows 10. In this post, we will introduce four methods.

How to Disable UAC Windows 10

Option 1: Disable UAC via Control Panel

Step 1: Type control panel in the search bar of Windows 10 and click this app in the result to open it.

Step 2: Go to User Accounts > Change User Account Control settings.

Step 3: Drag the slider control to Never notify and click OK to apply the change.

This way, the UAC is disabled and you won’t receive any notification. But this won’t completely disable User Account Control that is still active in the background.

Option 2: Disable UAC Windows 10 Command Line

Step 1: Run Command Prompt as administrator.

Step 2: To turn off UAC Windows 10, enter the following command and press Enter:

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f.

Step 3: Reboot your computer to let the change take effect.

Option 3: Disable UAC Group Policy

Step 1: Input Policy Editor in the Windows 10 search box and click Edit group policy.

Step 2: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.

Step 3: Scroll down to the bottom to find User Account Control: Run all administrators in Admin Approval Mode and double-click on it, choose Disabled and click OK.

Option 4: Disable UAC Windows 10 Registry Key

Step 1: Press Win plus R keys to launch the Run dialog.

Step 2: Input regedit.exe and click OK.

Step 3: Go to the path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Step 5: Save the change and restart your computer.

Now, we have shown you how to disable UAC Windows 10 in detail. In addition, you may want to set UAC to automatically deny elevation requests from users with standard-level credentials to avoid being prompted to enter administrator credentials to confirm all the time when running a program requiring elevated permissions.

How to Automatically Deny UAC Elevation Requests

You can do this work via Windows Registry or Group Policy.

In Group Policy, go to Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options, double-click on User Account Control: Behavior of the elevation prompt for standard users and choose Automatically Deny elevation requests.

In the Registry Editor window, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, double-click the ConsentPromptBehaviorUser key and change its Value data to 0 so that you can automatically deny UAC elevation requests.

The End

After reading this post, you will know clearly on how to disable UAC Windows 10 and how to change UAC for standard user to automatically deny elevation requests. Just try the methods above based on your needs to perform these operations to User Account Control.

About The Author

Vera is an editor of the MiniTool Team since 2016 who has more than 5 years’ writing experiences in the field of technical articles. Her articles mainly focus on disk & partition management, PC data recovery, video conversion, as well as PC backup & restore, helping users to solve some errors and issues when using their computers. In her spare times, she likes shopping, playing games and reading some articles.

How to Disable User Account Control (UAC) on Windows

Chris Hoffman is Editor-in-Chief of How-To Geek. He’s written about technology for over a decade and was a PCWorld columnist for two years. Chris has written for The New York Times and Reader’s Digest, been interviewed as a technology expert on TV stations like Miami’s NBC 6, and had his work covered by news outlets like the BBC. Since 2011, Chris has written over 2,000 articles that have been read more than one billion times—and that’s just here at How-To Geek. Read more.

User Account Control is an important Windows security feature. If a running application wants full access to your system, it has to ask with a UAC prompt. If you disable UAC, all running applications can gain Administrator access without asking first.

All modern versions of Windows, including Windows 11, Windows 10, Windows 8, Windows 7, and Windows Vista have User Account Control, and it’s enabled by default. It’s included on Windows Server, too. The instructions here will let you disable UAC on any version of Windows. UAC options are found in the classic Control Panel, even on Windows 11 and Windows 10.

Warning: We recommend against disabling UAC unless you have a specific reason to do so. For example, you may want to temporarily disable UAC while troubleshooting a software issue. If you do disable UAC, we recommend re-enabling it as soon as possible. UAC prevents applications from gaining full Administrator access to your operating system and could help limit the damage malware can do on your PC.

First, open the UAC settings window. To do so, open your Start menu (by pressing the Windows key or clicking the Start button). Type “UAC” or “User Account Control” into the search box in the Start menu.

Click “Change User Account Control Settings” in the search results.

In the User Account Control Settings window, click and drag the slider to the bottom position, which is “Never Notify.” With this setting, applications will be able to request Administrator access to your system and will immediately be granted that access without asking you first.

Click “OK” to save your choice. You will have to agree to one final UAC prompt to confirm the change. It will take effect immediately after you do.

The UAC slider gives you four separate options for choosing User Account Control behavior on Windows. Here are the options you can choose from:

To re-enable UAC in the future, re-open the User Account Control Settings window, drag the slider back to the default position, and click “OK.” Changes to your UAC settings will take immediately; you don’t have to reboot.

Again, we strongly recommend against disabling UAC unless you have a particularly good reason to do so. While the feature was very obnoxious and noisy when it debuted on Windows Vista, it’s been much more reasonable since Windows 7 and it still works well on Windows 10 and Windows 11 today. You may see quite a few UAC prompts when setting up a computer and installing your software, but they hopefully shouldn’t be too frequent after that—and they’re an important security feature that puts you in control over what applications can do on your PC.

How to Disable UAC in Windows 10

Use Control Panel or Registry Editor, but understand the risks

What to Know

This article describes how to disable UAC in Windows 10 using two different methods. We’ll also explain why you might want to turn off UAC and if it’s safe to do so.

How to Disable UAC in Windows 10

There are two primary methods. This first uses Control Panel and is what we recommend because it’s the «normal» technique and leaves little room for error. But if you like to work in the registry (or you need to for whatever reason), those steps are further down the page.

Control Panel

There’s an easy-to-use slider-style option in Control Panel to disable User Account Control.

Open Control Panel. One way to get there is to search for it using the search bar by the Start menu.

Choose User Accounts. If you see it again on the next page, select it once more.

Select Change User Account Control settings.

Drag the button to the very bottom, to Never notify, and then select OK.

Confirm the change with Yes.

Edit the Registry

Another way to completely disable UAC is through a Windows Registry tweak. It’s a bit more involved than the Control Panel method but still doable.

Open Registry Editor. The quickest way is to open the Run box with Win+R and then enter regedit.

Go to this path:

Double-click EnableLUA from the right side to open its settings.

Set the value to 0 and then select OK.

Restart your computer for the change to take effect.

Is It Safe to Turn Off UAC?

User Account Control’s default state is to be enabled. And for a good reason. Under normal circumstances, you’d get a prompt to confirm various actions before they can take place on your computer. Most notably, when installing programs, opening Registry Editor, and changing key system settings. Several tasks trigger the prompt.

What leads most people to want to disable UAC is that it can be annoying. Being bombarded by these prompts every time you want to run those tasks can seem intrusive. Most people probably don’t think twice when it appears, clicking as fast as possible to get past it and on to whatever it is they were doing before.

Although it’s easy to forget because of how often you see it, the prompt is there for a reason. If you’re not careful, you could accept a malicious program’s request for elevated privileges, which could ultimately lead to disastrous results. The rights it had before get upgraded because you gave it the go-ahead.

This process is put on auto-drive when UAC is off. All of those critical, system-related tasks that you should vet before taking place are granted elevated permissions without a second thought. Opening Registry Editor just. happens—no prompt. Program installations can proceed silently without your authorization. You can see just how dangerous that could be.

We don’t recommend that you turn off User Account Control. But if you have to temporarily for whatever reason, be sure to re-enable it when you finish your task.

Windows 11 Disable User Account Control (UAC)

There are multiple ways to disable the User Account Control (UAC) in Windows 11. UAC is a security layer that asks a user to confirm changes in the system different apps may try to make. By default, Windows 11 shows a UAC prompt when a program tries to run with elevated privileges (as Administrator).

Some people find this behavior annoying. If you share that view, this article will show you how to disable Windows 11 User Account Control.

How to Disable User Account Control in Windows 11

You can disable UAC using the Settings app or the classic Control Panel app. As you could guess, there is a corresponding Group Policy option for that. If the GUI methods are not your way, you can disable the User Account Control feature in the Windows 11 Registry. Finally, a variety of apps can help you to get the task done in a convenient way. Let’s review these methods.

Turn off UAC from the Control Panel and Settings

After that, Windows will stop notifying you and asking to confirm changes apps try to make on your computer. Note that Microsoft does not recommend disabling User Account Control.

Alternatively, you can disable screen dimming on UAC prompts. The system will continue asking for your confirmation for different actions but without dimming the screen. To do so, move the slider down to the second position from the bottom.

Note that none of the first three options show UAC prompts when you try to change Windows settings. If you want to increase Windows security as much as possible and prevent accidental changes in settings, move the slider up.

Disable User Account Control in Windows 11 using Windows Registry

You are done. Windows will disable User Account Control.

Ready-for-use registry files.

Here are pre-built registry files you can use to disable or enable User Account Control in Windows 11.

If Registry tweaks are not your way of changing Windows settings, there is an alternative method. If your Windows 11 edition includes the Local Group Policy editor app (gpedit.msc), you can use it instead.

Disable Windows 11 UAC with Group Policy

The changes will apply instantly. Note that Windows 11 Home doesn’t come with gpedit.msc, but the rest methods reviewed in this post work without issues

Disable User Account Control with Winaero Tweaker

Finally, here is how to turn off User Account Control in Windows 11 using Winaero Tweaker.

Now you know how to get rid of the User Account Control prompts in Windows 11.

Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options:

If you like this article, please share it using the buttons below. It won’t take a lot from you, but it will help us grow. Thanks for your support!

Author: Sergey Tkachenko

Sergey Tkachenko is a software developer who started Winaero back in 2011. On this blog, Sergey is writing about everything connected to Microsoft, Windows and popular software. Follow him on Telegram, Twitter, and YouTube. View all posts by Sergey Tkachenko