6

I'm looking for a way to set the UAC Level with Powershell/Command prompt. I'm aware the 'EnableLUA' value in the registry, but this won't set the level. It's just true or false.

Is there a way to set the UAC Level with Powershell? With level, I mean the four levels of UAC. They go from 'Never Notify' to 'Always Notify".

Thank you.

4 Answers 4

6

There are several registry values that control User Account Control:

  1. FilterAdministratorToken
  2. ConsentPromptBehaviorAdmin
  3. ConsentPromptBehaviorUser
  4. EnableInstallerDetection
  5. ValidateAdminCodeSignatures
  6. EnableLUA
  7. PromptOnSecureDesktop
  8. EnableVirtualization

The combination of these values is what controls the slider in the GUI, or vice-versa.

Reference: http://msdn.microsoft.com/en-us/library/cc232771.aspx

5

Actually there already existed a takeaway powershell script to you can make use of.

You can easily find them in How to switch UAC level

Hopefully, it can help.

Edit

The code from the mentioned Microsoft Technet site implements these cmdlets:

  • Set-UACLevel()
  • Get-UACLevel()

But they are not confirmed for this OS (12. Jan. 2017):

  • Windows Server 2012 R2
  • Windows Server 2008
  • Windows 7

Code snippet:

New-Variable -Name Key 
New-Variable -Name PromptOnSecureDesktop_Name 
New-Variable -Name ConsentPromptBehaviorAdmin_Name 
 
Function Set-RegistryValue($key, $name, $value, $type="Dword") {  
  If ((Test-Path -Path $key) -Eq $false) { New-Item -ItemType Directory -Path $key | Out-Null }  
       Set-ItemProperty -Path $key -Name $name -Value $value -Type $type  
}  
 
Function Get-RegistryValue($key, $value) {  
   (Get-ItemProperty $key $value).$value  
}  
 
$Key = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" 
$ConsentPromptBehaviorAdmin_Name = "ConsentPromptBehaviorAdmin" 
$PromptOnSecureDesktop_Name = "PromptOnSecureDesktop" 
 
Function Get-UACLevel(){ 
    $ConsentPromptBehaviorAdmin_Value = Get-RegistryValue $Key $ConsentPromptBehaviorAdmin_Name 
    $PromptOnSecureDesktop_Value = Get-RegistryValue $Key $PromptOnSecureDesktop_Name 
    If($ConsentPromptBehaviorAdmin_Value -Eq 0 -And $PromptOnSecureDesktop_Value -Eq 0){ 
        "Never notIfy" 
    } 
    ElseIf($ConsentPromptBehaviorAdmin_Value -Eq 5 -And $PromptOnSecureDesktop_Value -Eq 0){ 
        "NotIfy me only when apps try to make changes to my computer(do not dim my desktop)" 
    } 
    ElseIf($ConsentPromptBehaviorAdmin_Value -Eq 5 -And $PromptOnSecureDesktop_Value -Eq 1){ 
        "NotIfy me only when apps try to make changes to my computer(default)" 
    } 
    ElseIf($ConsentPromptBehaviorAdmin_Value -Eq 2 -And $PromptOnSecureDesktop_Value -Eq 1){ 
        "Always notIfy" 
    } 
    Else{ 
        "Unknown" 
    } 
} 
     
Function Set-UACLevel() { 
    Param([int]$Level= 2) 
 
    New-Variable -Name PromptOnSecureDesktop_Value 
    New-Variable -Name ConsentPromptBehaviorAdmin_Value 
 
    If($Level -In 0, 1, 2, 3) { 
        $ConsentPromptBehaviorAdmin_Value = 5 
        $PromptOnSecureDesktop_Value = 1 
        Switch ($Level)  
        {  
          0 { 
              $ConsentPromptBehaviorAdmin_Value = 0  
              $PromptOnSecureDesktop_Value = 0 
          }  
          1 { 
              $ConsentPromptBehaviorAdmin_Value = 5  
              $PromptOnSecureDesktop_Value = 0 
          }  
          2 { 
              $ConsentPromptBehaviorAdmin_Value = 5  
              $PromptOnSecureDesktop_Value = 1 
          }  
          3 { 
              $ConsentPromptBehaviorAdmin_Value = 2  
              $PromptOnSecureDesktop_Value = 1 
          }  
        } 
        Set-RegistryValue -Key $Key -Name $ConsentPromptBehaviorAdmin_Name -Value $ConsentPromptBehaviorAdmin_Value 
        Set-RegistryValue -Key $Key -Name $PromptOnSecureDesktop_Name -Value $PromptOnSecureDesktop_Value 
 
        Get-UACLevel 
    } 
    Else{ 
        "No supported level" 
    } 
     
} 
 
Export-ModuleMember -Function Get-UACLevel 
Export-ModuleMember -Function Set-UACLevel
1
  • I can confirm Set-UACLevel 0 works on Windows 10
    – masterxilo
    Oct 21, 2023 at 10:49
3

Thank you very much, I got it. The following .REG file will set the UAC to Level 2.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000001
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"FilterAdministratorToken"=dword:00000000
2

The following will set to Level 1 (Much like the answer above me) Level 1 is the same as Level 2 but does not black out the screen (Better for remote desktop usage etc)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000001
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000000
"ValidateAdminCodeSignatures"=dword:00000000
"FilterAdministratorToken"=dword:00000000

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .