2

In Windows 10, if a user on a standard account attempts to perform a task that requires administrative privileges, they are asked to type in a password of an administrative account, on behalf of which they may perform this task, provided they type in the password correctly.

Is there any way to prevent this behavior, that is, to prohibit standard users from performing administrative tasks and prevent them from being asked for an administrative password? So that they cannot perform administrative tasks no matter what, as long as they're logged into a standard account?

9
  • In Linux, I can prohibit others from using su, so I doubt I'd be unable to do sth similar in Windows...
    – gaazkam
    Dec 5, 2016 at 2:44
  • 3
    Your regular users shouldn't know the admin passwords.
    – Journeyman Geek
    Dec 5, 2016 at 3:17
  • @JourneymanGeek You are right of course, but despite that I still think in my special case this what I want to do is justified :)
    – gaazkam
    Dec 5, 2016 at 3:37
  • There may be some sort of a shell tweak that hides the "Run as administrator" option
    – timotree
    Dec 5, 2016 at 4:00
  • 1
    It's possible on Windows 7 using secpol, see Hide User Account Control prompts for non-administrative users. This will Automatically deny elevation requests. I don't have a copy of Windows 10 to see if this works there as well.
    – DavidPostill
    Dec 5, 2016 at 22:32

1 Answer 1

1

Is there any way to prohibit standard users from performing administrative tasks?

and prevent them from being asked for an administrative password?

Yes this is possible using the Security Policy Editor (secpol).

See the instructions below.

Note:

  • Although the instructions are aimed at Windows 7 that particular group policy is also available on a Windows 10 Pro machine.

Hide User Account Control prompts for non-administrative users

Follow these steps to eliminate UAC prompts for standard users:

  • Click on the start menu, type "secpol.msc" and hit Enter.

  • When the "Local Security Policy" editor ("snap-in") opens, double-click on "Local Policies" -for those affecting this particular machine- and double-click on "Security Options".

  • Scroll down until you see a node labeled "User Account Control: Behavior of the Elevation Prompt for Standard Users" (careful, another policy starts with the same name, but actually affects computer administrators!) Double-click on it and the following dialog will open:

    Customize Windows 7 UAC prompts behavior for standard users

  • The default behavior for standard users, selected in the dropdown menu pictured above, is "Prompt for credentials": whenever elevated privileges are required, they'll need to select an administrator and enter its password in a UAC prompt to proceed with the action.

  • Click on the dropdown, and select the "Automatically deny elevation requests" option instead; click "OK" to apply the new setting: from this point on, standard users won't event get a UAC prompt when they attempt any task that needs administrative permissions.

Note that this setting takes effect immediately, so make sure that you and/or someone else does have the full administrator credentials, which will sooner or later be needed to logon to that computer. While this is a very secure setting, that eliminates possibilities even for those who have admin name and password, it can also become very impractical, especially for advanced "power" users, who'll find their computing experience quite frustrating! Be sure to see how you can also hide usernames and only show blank text boxes on the Windows 7 logon screen for an even safer computer.

Source Prevent standard users from getting the Windows 7 UAC / administrator password prompt

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .