{"id":32015,"date":"2023-01-17T11:17:41","date_gmt":"2023-01-17T05:47:41","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=32015"},"modified":"2023-01-17T11:17:41","modified_gmt":"2023-01-17T05:47:41","slug":"make-uac-ask-password-admins","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/make-uac-ask-password-admins\/","title":{"rendered":"How to Make UAC Always ask for Password on Admin Accounts"},"content":{"rendered":"

When you’re login to an admin account and initiate an action that requires administrative rights (elevation of privilege), the UAC will ask for consent (instead of the username and password.) You select either Yes (“Permit”) or No (“Deny”) in the consent dialog. This operation will happen on the secure desktop. However, Windows binaries will be allowed to perform an operation that requires elevation without consent or credentials. This is the default behavior for admin-approval mode in Windows.<\/p>\n

You may wonder how to configure UAC to always ask for the username and password when executing an action requiring administrative rights on admin accounts. This article tells you how to do that. The instructions apply to Windows Vista through Windows 11.<\/p>\n

Make UAC Always ask for a Password on Admin Accounts<\/h2>\n

You can use the Local Security Policy editor to change the UAC admin approval mode setting for Windows Professional Edition and higher. On Windows Home Editions, follow the registry method.<\/p>\n

Option 1: Using the Security Policy editor<\/h3>\n
    \n
  1. Right-click Start, and click Run.<\/li>\n
  2. Type secpol.msc<\/strong><\/code> and hit Enter. This opens the Local Security Policy editor.<\/li>\n
  3. Expand Security Settings \u2192 Local Policies \u2192 Security Options
    \n\"UAC<\/li>\n
  4. Double-click User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode<\/li>\n
  5. Select one of the following options, and click OK.\n
    Prompt for credentials on the secure desktop\r\n(or)\r\nPrompt for credentials<\/pre>\n<\/li>\n<\/ol>\n
    This ensures that the UAC dialog always asks for admin credentials when executing an action (from an admin account) that requires an elevation of privilege.<\/p>\n
    \n
    Option 2: Using the Registry Editor<\/h3>\n
      \n
    1. Launch the Registry Editor (regedit.exe<\/code>)<\/li>\n
    2. Go to the following key:\n
      HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System<\/pre>\n<\/li>\n
    3. Double-click ConsentPromptBehaviorAdmin<\/strong><\/code> and set its data to 5.\n
      Here is the list of possible data for ConsentPromptBehaviorAdmin<\/strong><\/code><\/div>\n
      0 \u2192 Elevate without prompting\r\n1 \u2192 Prompt for credentials on the secure desktop\r\n2 \u2192 Prompt for consent on the secure desktop\r\n3 \u2192 Prompt for credentials\r\n4 \u2192 Prompt for consent\r\n5 \u2192 Prompt for consent for non-Windows binaries (Windows default)<\/pre>\n
      Difference between the settings #1 & #3:<\/p>\n