How to automatically deny UAC elevation requests in Windows 10

To install an app in Windows 10, standard level users are prompted for elevated credentials. With a few tweaks, you can change that behavior to deny such requests.

istock-479209068.jpg

Image: anyaberkut, Getty Images/iStockphoto

For a standard level user of Microsoft Windows 10, any attempt to run or install an application requiring elevated or administrative privileges will be met with a prompt from the User Access Control (UAC) system. The user will then have to enter the proper credentials to continue. This security procedure plays a vital role in protecting PCs running Windows 10 from malware and other nefarious applications.

With an edit or two of some very specific configuration settings, you can change the normal prompting behavior in Windows 10 to automatically deny the UAC elevation request from standard-level users. Modifying this behavior can be useful in networked environments (business or personal) where standard users are not allowed to install unauthorized applications—ever.

This tutorial shows you how to edit configuration settings in Windows 10 using both the Local Policy Editor and the Registry Editor to automatically deny UAC elevation requests from users with standard-level credentials.

SEE: Windows 10 May 2019 Update: 10 notable new features (free PDF) (TechRepublic)

How to automatically deny UAC elevation requests with policy editor

If your PC is running Windows 10 Pro, the most effective way to change UAC behavior is with the Local Group Policy Editor. Type "edit group policy" into the search box on your Windows 10 desktop and click or tap the appropriate item in the list of results.

Navigate to this folder, shown in Figure A:

Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options

a-change-uac-win10.jpg

Figure A

In the righthand window, scroll down until you reach a setting with this label:

User Account Control: Behavior of the elevation prompt for standard users

Double-click it to open the policy screen as shown in Figure B. Click the dropdown menu to change the setting to automatically deny an elevated UAC prompt. Click OK to apply the change.

b-change-uac-win10.jpg

Figure B

If at any time you want to change back to the default behavior, just reopen the setting using the Local Group Policy Editor.

How to automatically deny UAC elevation requests with registry edit

Disclaimer: Editing the Windows Registry file is a serious undertaking. A corrupted Windows Registry file could render your computer inoperable, requiring a reinstallation of the Windows 10 operating system and potential loss of data. Back up the Windows 10 Registry file and create a valid restore point before you proceed.

To change UAC prompt behavior for non-Pro versions of Windows 10, you will have to edit the Windows Registry file. Type "regedit" into the desktop search box and click or tap the appropriate result from the list.

Navigate to this key in the registry editor, as shown in Figure C:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

c-change-uac-win10.jpg

Figure C

Find the key labeled ConsentPromptBehaviorUser and double-click it to reveal the configuration screen shown in Figure D.

d-change-uac-win10.jpg

Figure D

The Value can be set to 0, 1, or 3. Unfortunately, the editor does not indicate what setting each number represents. Here are the available choices:

0 – Automatically deny elevation requests

1 – Prompt for credentials on the secure desktop

3 – Prompt for credentials (Default)

Change the value to zero and then click OK to confirm your choice. Exit out of the registry editor app to complete the process.

Now, when a user with standard-level credentials attempts to install an application or perform some other activity requiring elevated credentials, they will be denied automatically without prompting.

Also see