Learn about the nature of UAC in Windows and how to use this setting to control Windows user permissions

When Windows Vista was first announced, the User Account Control (UAC) feature almost immediately received quite a bit of backlash from the user community.

According to security experts, this is a pretty good security solution, but most users still choose to turn off UAC and accidentally "reveal" existing vulnerabilities in the system.

This feature has been improved quite a bit in subsequent versions of Windows and although it makes the operating system much more secure, some users still want to disable UAC.

In the following article, Quantrimang.com will go into the specific details of what UAC is, how UAC works, and the benefits of enabling this feature in any version of Windows.

What is User Account Control (UAC)?

• What is User Account Control (UAC)?
• What does a User Account Control (UAC) prompt look like? What does it share and ask for?
• How do I know that a file or setting will trigger a UAC prompt?
• How does User Account Control (UAC) work?
• What changes require Administrator rights?
• Should I disable UAC when installing a program and enable it again afterwards?
• How to configure UAC settings

What is User Account Control (UAC)?

UAC, short for User Account Control, is a Windows security feature that helps prevent unauthorized changes to the operating system. These changes can be initiated by applications, users, viruses, or other forms of malware.

User Account Control ensures that certain changes can only be made with administrator approval. If changes are not approved by the administrator, they will not be implemented and Windows will remain unchanged, as if nothing happened. UAC was first introduced with Windows Vista and has been improved with each new version of Windows since then.

What does a User Account Control (UAC) prompt look like? What does it share and ask for?

When you double-click a file, setting, or app that's about to make important changes to Windows, you'll see a User Account Control (UAC) prompt. If your user account is an administrator, the prompt will look like the screenshot below. Here you can see the UAC prompt in Windows 10 (top), Windows 7 (middle), and Windows 8.1 (bottom).

The UAC prompt displays the name of the program that is about to make a system change that requires the approval of the administrator, the publisher of that program, and the origin of the file (if you are trying to run the file). All it needs from the administrator is to click or tap Yes , to allow the program or file to make the changes it wants.

If your user account is not admin, the prompt will be different. For example, in Windows 10, the UAC prompt asks for a PIN (if one has been set) or an admin password.

In Windows 7 and Windows 8.1, the UAC prompt always asks for the admin password, as shown below.

When this happens, you need to enter your admin PIN or password and click Yes. Unless both actions are performed, the requested changes will not be made.

The UAC prompt also has a link that says " Show more details " (in Windows 10) or " Show details " (in Windows 7 and Windows 8.1). If you click it, you'll see more information including the exact location on your drive of the program or file and the publisher's certificate, which tells you more about who created what you want to run.

How do I know that a file or setting will trigger a UAC prompt?

Files that trigger a UAC prompt when run have a UAC icon in the lower right corner of their file icon, similar to the screenshot below.

Applications and system settings that trigger UAC prompts also have the UAC icon near their name or in their icon. You can see some examples highlighted below, found in Control Panel .

Remember the UAC icon and every time you see it, you will know in advance that you are about to need admin approval.

How does User Account Control (UAC) work?

In Windows, applications run without any administrative rights by default. They have the same rights that standard user accounts have: They cannot make any changes to the operating system, system files, or registry settings. Additionally, they cannot change anything owned by other user accounts. Applications can only change their own files and registry settings or the user's files and registry settings.

When an application wants to make changes to the system, such as: Changes that affect other user accounts, modify Windows system files and folders, install new software, a UAC prompt is displayed, asking for permission. If the user clicks No , the changes will not be made. If the user clicks Yes (and enters the administrator password, if prompted), the application will receive administrative rights and it can make changes to the system as it wishes. These rights are only given until the application stops running or is closed by the user. The same goes for files that trigger a UAC prompt.

For better understanding, the UAC algorithm is explained in the diagram below.

What changes require Administrator rights?

Basically, there are quite a few changes that require Administrator rights to perform, on the other hand they also depend on how UAC is adjusted. Specifically, the changes we are talking about include:

• Activate a program
• Change system settings, or files in the Windows & Program Files folder
• Install, remove drivers or software
• Delete or add user accounts
• View or change other users' folders and files
• Windows Update Configuration
• Change settings to Windows Firewall
• Change UAC settings
• Change user account type
• Run Task Scheduler
• Restore backed up system files
• Change system date and time
• Configure Parental Controls or Family Safety
• Install ActiveX controls (in Internet Explorer)

Should I disable UAC when installing a program and enable it again afterwards?

The biggest annoyance for users is when they install Windows and their most used desktop applications. During this process, a lot of UAC prompts are displayed and you can temporarily disable it, while installing all the applications and re-enable it when finished.

In some situations, this can be a bad idea. Desktop applications that make a lot of system changes may not work if UAC is enabled after you install them. However, they will work properly if you install them with UAC enabled.

When UAC is turned off, the virtualization techniques used by UAC for all applications are not active. This causes certain user settings and files to be installed in a different location. They will not work when UAC is turned back on. To avoid such problems, it is better to keep User Account Control (UAC) enabled at all times.

How to configure UAC settings

To configure UAC settings, open the Start menu, type user account control , and click to open User Account Control settings . Alternatively, you can access UAC through Control Panel > User Accounts > User Account > Change User Account Control Settings .

The default User Account Control setting is set to Notify me only when apps try to make changes to the computer (default) . The default setting is recommended for most users who install apps from trusted sources and visit familiar websites.

However, you can change the settings using the slider on the left. Here are the four UAC options you can choose from:

1. Always notify me when : This is the most strict option. Windows will display a UAC prompt with a dimmed desktop environment when you try to install an application on your computer. However, you will also see a UAC prompt when you change Windows system settings to ensure that applications cannot make changes without the user's consent.
2. Notify me when apps try to make changes to my computer : This is the default option. Windows will ask you for permission when you install an app or try to run an app with admin rights. However, changing most system settings will not trigger a UAC prompt.
3. Notify me only when apps try to make changes to my computer (do not dim my desktop) : Use this option to safely disable dimmed desktops for UAC prompts. The dimmed desktop environment is a security feature that prevents other applications from interfering with the visual appearance of the UAC dialog. Use this option only if it takes a long time to dim the desktop.
4. Never notify me : This option turns off UAC and should only be used when troubleshooting problems with an application or your computer. When set to off, Windows will not notify you when you try to install an application or make changes with administrative privileges. However, turning off UAC can make your computer vulnerable to unauthorized changes, so it is important to use this option with caution.

While UAC adds security to your system, there are additional steps you can take to protect your computer. Use a strong PIN or password to prevent unauthorized access, only install apps from trusted sources, preferably the Windows Store and the developer's official website, and make sure your system has the latest Windows security updates as they become available.