Disable User Account Control (UAC) in Windows 7

Originally published 17 January 2009 / Filed under Windows / Server

Archived note. Originally published 17 January 2009 on iishacks.com, before Windows 7 reached general release later that year. It describes User Account Control as it behaved in that version and is preserved as a record. Windows 7 is past end of support, and disabling UAC removes a security boundary that later Windows versions depend on more heavily than Windows 7 did. Verify against current vendor documentation before applying any of it to a live system.

What this page is and is not

This is a record of a procedure, not a recommendation to carry it out. User Account Control is a security boundary: it stops a program running as a standard user from silently acquiring administrative rights, and forces a program that wants those rights to say so where somebody can see it. Turning it off does not make a machine faster or tidier. It removes the boundary.

The original note said as much in its own way, judging the Windows 7 default prompts sufficient for the average user, and that judgement is worth repeating. Windows 7 rebuilt the feature to reduce the prompt volume that had made the Windows Vista implementation unpopular, and for most machines the shipped setting is the correct one.

Where the prompts are genuinely disruptive, the slider positions between the default and Never notify are almost always the better answer than switching the feature off: they keep the elevation boundary intact and change only how loudly it announces itself. The methods below are recorded because they were the methods, not as an endorsement of the end state.

The recovered note

Modifying the User Account Control options in Windows 7 is slightly different from Windows Vista. The default prompts in Windows 7 are sufficient for the average user. There are cases where a user would want to disable UAC, or where a network administrator would want to disable it across many machines through Group Policy. Below are three methods to turn it up, turn it down, or disable it completely.

Method 1 — Control Panel

Start menu, then Control Panel, then User Accounts and Family Safety, then User Accounts, then Change User Account Control settings.

Method 2 — Registry Editor

1. Type regedit in the Start menu search box.
2. Go to the following key:

   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System

3. Locate the REG_DWORD value EnableLUA and set it to 0.
4. Locate the REG_DWORD value ConsentPromptBehaviorAdmin and set it to 0.
5. Restart.

Method 3 — Group Policy

1. Type gpedit.msc in the Start menu search box.
2. Open Computer Configuration, then Windows Settings, then Security Settings, then Local Policies, then Security Options.
3. Scrolling to the bottom of that list shows the User Account Control settings.
4. Set User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode to Elevate without prompting.
5. Set User Account Control: Detect application installations and prompt for elevation to Disabled.
6. Set User Account Control: Run all administrators in Admin Approval Mode to Disabled.
7. Set User Account Control: Only elevate UIAccess applications that are installed in secure locations to Disabled.
8. Restart.

A transcription repair

The archived copy of this post lost the backslashes from the registry path, which appears in the capture as a single unbroken string. It is restored above to its correct form, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System. That is a repair to a damaged capture rather than an addition to the original text, noted here so the difference from the archived copy is on the record.

What the settings actually change

The three methods are not equivalent, and the difference is easy to miss because all three get described as disabling UAC.

The Control Panel slider has four positions, running from notifying on every change through two intermediate settings to never notifying at all. Moving it changes how and when the consent prompt appears. It does not tear the mechanism out.

ConsentPromptBehaviorAdmin set to zero changes the elevation behaviour alone: an administrator's elevation requests are granted without a prompt. EnableLUA set to zero is a much larger change. It switches off the whole facility, not just the prompt — including the split-token model that gives an administrative account a standard-user token for ordinary work, and the file and registry virtualisation that redirects older applications writing to protected locations. Applications relying on that redirection can behave differently once it is gone, which is one reason the change requires a restart.

The Group Policy route reaches the same values through a supported, auditable and centrally deployable interface, which is the only sensible way to do it on more than one machine. It also makes the state visible: a policy appears in a report, an edited registry value on one machine does not.

Why the lower slider positions are the better answer

The complaint that leads people here is rarely about security. It is about being interrupted — usually by one badly behaved application that asks for elevation far more often than it needs to, or by an administrative session in which every routine action raises a dialog.

The slider answers that complaint without giving anything important away. The intermediate positions keep elevation as a real boundary, keep the split token and virtualisation, and keep the prompt for the cases that matter, while removing the desktop dimming and the notifications for changes made through Windows' own tools. The interruption largely goes away and the boundary stays.

Switching the feature off entirely answers a different question, permanently. Every process an administrator starts runs with full rights, elevation stops being an observable event, and anything arriving by way of a browser, a mail attachment or an installer inherits those rights without asking. On a workstation that browses the internet, that is a poor trade for a quieter dialog. Where one application genuinely misbehaves, fixing or replacing it is the smaller change.

Reading it today

Windows 7 is past end of support and the mechanism has moved on since. Modern Windows layers a great deal on the same boundary, so switching it off now disables noticeably more than it did in 2009. Support dates are published in the Microsoft product lifecycle documentation, and NIST SP 800-123, the Guide to General Server Security covers the least-privilege principle this feature exists to enforce.

Other Windows notes are filed under Windows and Server, with security material under Security, viruses and trojans. The note on Windows 7 desktop icons and shortcuts disappearing covers another Windows 7 default routinely switched off rather than understood, and every recovered post is indexed at post archives.