Thursday, June 5, 2008

Vista SP1 UAC Explained

Click here for an interesting screencast on Vista SP1 user account control. Microsoft have collected user experience stats covering more than 10,000 real world machines and found that after initial setup, 66% of user sessions don't contain UAC prompts. I expect that UAC prompts will become less of an issue in the future as venders update their software to minimise the use of administration permissions. However, if you are an advanced Windows user and want to disable the elevation prompts but still enjoy the protection of UAC, it's really easy to do. Note that this is different to disabling UAC through the security centre.

  1. Open the start menu
  2. Type secpol.msc in the search box
  3. Run secpol.msc by pressing enter
  4. Navigate through the security settings tree to find Local Policies | Security Options
  5. Scroll down through the list of policies to find the User Account Control entries
  6. Select the following policy and open it by pressing enter
    Behaviour of the elevation prompt for administrators in Admin Approval Mode
  7. Choose Prompt for consent from the list of settings
  8. Press the OK button

From now on, Admin elevations will occur without the prompt. Obviously, this only works if you are an Admin user and UAC is enabled in Security Centre. If you're running Vista with UAC disabled, I recommend that you turn it back on and instead disable the prompt.

secpol-UAC

UAC-ElevateWithoutPrompt

Note that Secpol.msc is not available on all versions of Windows Vista but the same result can be achieved through the registry.

  1. Open the start menu
  2. Type regedit in the search box
  3. Run regedit.exe by pressing enter
  4. Navigate through the tree to find the following key
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  5. Select the following value from the list and open it by pressing enter
    ConsentPromptBehaviorAdmin
  6. Change the value data from 2 to 0 (zero), as shown below
  7. Press the OK button

ConsentPromptBehaviorAdmin

2 comments:

  1. Seems you can't do this easily in Home Premium (and presumably Home Basic) because secpol.mmc doesn't exist. Any idea how it can be done?

    ReplyDelete
  2. Hi Terry
    I've added some extra instructions for how to disable UAC prompts by editing the registry.
    Cheers
    WJ

    ReplyDelete