I would like to have an administrator account just for UAC prompts. Is it possible to disable the desktop feature? So that I just can use that account for UAC prompts only and not actually login to see the desktop or something?

I tried changing the gpedit.msc option Deny log on locally. But after that I couldn't login anymore, even at the UAC prompts.

Is there any other way?

  • No, there isn't. – harrymc Mar 16 '19 at 10:02

The configuration you're asking for is not possible because:

  1. Only an administrator can complete a UAC prompt.
  2. An administrator user can change any setting in Windows.
  3. Therefore, an administrator can revert a deny logon setting.

As a result, there is no configuration available in Windows that can effectively create the result you're asking for. As shown above, even if you could put one in place, the administrator could defeat it.

Additionally, the UAC architecture requires that the user account used to elevate processes not be denied the log on locally user right.

  • Despite this, would it meet your purposes to simply hide the administrator account from the login screen? If so, I can edit my answer to explain how to do this. @Phil – I say Reinstate Monica Mar 16 '19 at 14:46
  • Though again, the admin could defeat this setting too. – I say Reinstate Monica Mar 16 '19 at 15:01
  • 1
    A user not being able to log into Windows, but sill authenticate, would not increase security on your system (even if it was possible it would serve no purpose). – Ramhound Mar 16 '19 at 15:46
  • @Ramhound I certainly don't want to improve security with this. It was just asking because I was intereseted. – phrogg Mar 17 '19 at 15:21
  • You're welcome. Please mark this answer accepted if it answered your question. – I say Reinstate Monica Mar 17 '19 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.