I am one of the very few who likes the security of UAC and so I have the UAC set to "Always Notify" on my Admin account. But I would be even happier if the system would prompt me for a password, when notifying me.

I can get what I want by adding a second non-admin user and using that account.

But somehow it seems wasteful to have two accounts set up when I will always use the non-admin account day-to-day.

So I am wondering if there is any setting that would cause an Admin account to behave password-prompting-wise as a standard account?

  • 2
    Why do you want to have to type your password in? It's not more secure - applications can't interface with the UAC dialogues. – Phoshi Jan 4 '10 at 23:26
  • 3
    Too easy to just hit OK. Entering a password adds a few moments of sober second thought. – Bill Rodman Jan 4 '10 at 23:53

I love UAC as well! (Well, love maybe to strong... I wish a few things were different, but I like it a lot!)

Anyway, to do what you want, simply launch Local Group Policy Editor (Run > gpedit.msc) and expand Local Computer Policy > Windows Settings > Security Settings > Local Policies > Security Options Scroll to the bottom of the content window and look for User Account Control: Behavior of the elevation prompt for administrator in Admin Approval Mode and change it from Prompt for consent to Prompt for credentials or whatever settings you want.

alt text

There are a bunch of other UAC related options, Take a look - you may find something else you want to change!

  • GodMode (what's next?) is another way to open the group policy editor (and a LOT more): create a new folder (e.g. on the desktop) and name it as follows: GodMode.{ED7BA470-8E54-465E-825C-99712043E01C} – Molly7244 Jan 4 '10 at 23:41
  • 3
    @Molly - It's not God Mode!... You can write ANYTHING, it is a GUID shortcut to all the tool tips from control panel. – William Hilsum Jan 5 '10 at 0:02
  • I am running Windows 7 Home Premium. Do I have a group policy editor? Can't seem to find it. By the way, GodMode is mega-cool! – Bill Rodman Jan 5 '10 at 0:08
  • 1
    @Wil: No "local security policy" either. @Molly: Tried your suggestion, with no luck. I was thinking of upgrading to "Professional", anyway, so this may be another reason to do it. I hate products with multiple tiers: huge support issues. Thanks for all your help. – Bill Rodman Jan 5 '10 at 12:58
  • 2
    You don't need the group policy editor to change this. It's a registry setting which you can change manually. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "ConsentPromptBehaviorAdmin"=dword:00000001 – nhinkle Jan 10 '10 at 21:40

If you don't have Vista or Windows 7 Professional then, as others have noted, you won't have secpol.msc and so there is no interface for adjusting the relevant settings. However, you can still change them with the trusty old Registry Editor.

The relevant values may be found under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and are as follows.

  • ConsentPromptBehaviourAdmin: set this to 3 (prompt for credentials) or 1 (prompt for credentials on secure desktop)
  • ConsentPromptBehaviourUser: set this to 3 (prompt for credentials) or 1 (prompt for credentials on secure desktop)
  • PromptOnSecureDesktop: where the previous two values are set to 3, this will cause their prompts to appear on the secure desktop; if the previous two values are 1, then this setting is ignored.

Finally, here is Microsoft's own documentation for these keys: http://technet.microsoft.com/en-us/library/dd835564(v=ws.10).aspx#BKMK_RegistryKeys. IMO their documentation does not make explicit enough the effect of PromptOnSecureDesktop on the other two options that I list above. The key upsight is that, where the documentation says "prompt for {consent,credentials}" without explicitly saying "on the secure desktop", the value of PromptOnSecureDesktop determines whether the user is switched to the secure desktop for prompting.

  • 1
    +1 Accepted answer didn't work for me on Windows 8.1 (gpedit.msc not found), but editing registry key worked. – Kip Dec 3 '14 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.