User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
Applies to
- Windows 11
- Windows 10
Describes the best practices, location, values, policy management and security considerations for the User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode security policy setting.
Reference
This policy setting determines the behavior of the elevation prompt for accounts that have administrative credentials.
Possible values
Elevate without prompting
Assumes that the administrator will permit an operation that requires elevation, and more consent or credentials aren't required.
Note Selecting Elevate without prompting minimizes the protection that is provided by UAC. We don't recommend selecting this value unless administrator accounts are tightly controlled and the operating environment is highly secure.
Prompt for credentials on the secure desktop
When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege.
Prompt for consent on the secure desktop
When an operation requires elevation of privilege, the user is prompted on the secure desktop to select Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.*
Prompt for credentials
An operation that requires elevation of privilege prompts the administrator to type the user name and password. If the administrator enters valid credentials, the operation continues with the applicable privilege.
Prompt for consent
An operation that requires elevation of privilege prompts the administrator to select Permit or Deny. If the administrator selects Permit, the operation continues with the administrator's highest available privilege.
Prompt for consent for non-Windows binaries
This prompt for consent is the default. When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.
*If you've enabled the built-in Administrator account and have configured Admin Approval Mode, you must also configure the option Prompt for consent on the secure desktop. You can also configure this option from User Account Control, by typing UAC in the search box. From the User Account Control Settings dialog box, set the slider control to Notify me only when apps try to make changes to my computer (default).
Note
After enabling Admin Approval Mode, to activate the setting, you must first log in and out. Alternatively, You may perform gpupdate /force from an elevated command prompt.
Best practices
Selecting the option Elevate without prompting minimizes the protection that is provided by UAC. We don't recommend selecting this value unless administrator accounts are tightly controlled and the operating environment is highly secure.
It's recommended not to enable the built-in Administrator account on the client computer, but to use the standard user account and User Account Control (UAC) instead. If you want to enable the built-in Administrator account to carry out administrative tasks, for security reasons you should also enable Admin Approval Mode. For more information, see UAC-Admin-Approval-Mode-for-the-Built-in-Administrator-account
Location
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
Default values
| Server type or GPO | Default value |
|---|---|
| Default Domain Policy | Not defined |
| Default Domain Controller Policy | Not defined |
| Stand-Alone Server Default Settings | Prompt for consent for non-Windows binaries |
| DC Effective Default Settings | Prompt for consent for non-Windows binaries |
| Member Server Effective Default Settings | Prompt for consent for non-Windows binaries |
| Client Computer Effective Default Settings | Prompt for consent for non-Windows binaries |
Policy management
This section describes features and tools that are available to help you manage this policy.
Restart requirement
None. Changes to this policy become effective without a computer restart when they're saved locally or distributed through Group Policy.
Group Policy
All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU).
Security considerations
This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
Vulnerability
One of the risks that the UAC feature tries to mitigate is that of malicious software running under elevated credentials without the user or administrator being aware of its activity. This setting raises awareness to the administrator of elevated privilege operations, and it permits the administrator to prevent a malicious program from elevating its privilege when the program attempts to do so.
Countermeasure
Configure the User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode setting to Prompt for consent.
Potential impact
Administrators should be made aware that they'll be prompted for consent when all binaries attempt to run.