Remote uac windows 10

User Account Control (UAC) или контроль учетных записей – это функция безопасности Windows включенная по умолчанию и предназначенная для предотвращения нежелательных изменений в ОС. Если программа пытается выполнить действие, требующее прав администратора (например, установить программу, изменить настройки ОС, ветки реестра или системные файлы), UAC уведомляет об этом и запрашивает подтверждения этих действий у администратора. Тем самым снижается риск несанкционированных изменений и выполнения вредоносного кода с правами администратора.

В этой статье мы рассмотрим, как управлять настройками контроля учетных записей в Windows

Как выглядит окно UAC? Например, при попытке повышения привилегий процесса в сессии пользователя с правами локального администратора, появляется окно подтверждения UAC:

Контроль учетных записей
Разрешить этому приложению вносить изменения на вашем устройстве?

User Account Control
Do you want to allow this app to make changes to your device?

Картинка с сайта: winitpro.ru

Настройки контроля учётных записей (UAC) в Windows

Для управления настройками UAC в панели управления Windows доступен специальный апплет Change User Account Control settings, который можно запустить из классической панели управления или с помощью команды
UserAccountControlSettings.exe
.

С помощью ползунка можно выбрать уровень контроля учетных записей на компьютере. Доступно 4 уровня:

• Уровень 4 — Always notify — Всегда уведомлять (максимальный уровень защиты UAC);
• Уровень 3 — Notify only when programs try to make changes to my computer (default) – Уведомить только когда программа пытается внести изменения в мой компьютер (используется в Windows по умолчанию);
• Уровень 2 — Notify only when programs try to make changes to my computer (do not dim my desktop) – то же что и предыдущий уровень, но без переключения на Secure Desktop с блокировкой рабочего стола;
• Уровень 1 — Never notify – Никогда не уведомлять

Картинка с сайта: winitpro.ru

Обратите внимание, что перевод ползунка в нижнее положение Никогда не уведомлять, не отключает UAC полностью. Этот режим включает автоматическое подтверждения запросов на повышение прав, инициированных администратором, без отображения окна с запросом UAC. В сессиях пользователей запросы повышения прав автоматически откланяются.

Чтобы полностью отключить UAC, нужно отключить параметр локальной политики Контроль учетных записей: все администраторы работают в режиме одобрения администратором (User Account Control: Run all administrators in Admin Approval Mode). Об этом ниже.

Управление параметрами User Account Control через GPO

Возможно управление параметрами контроля учетных записей UAC в Windows через групповые политики. Имена политик, относящихся к UAC, начинаются с User Account Control (Контроль учетных записей) и находятся в разделе редактора GPO Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options (Конфигурация компьютера –> Конфигурация Windows –> Параметры безопасности –> Локальные политики).

Картинка с сайта: winitpro.ru

Доступно 12 параметров GPO. В следующей таблице представлен список политик UAC, и соответствующие им параметры реестра (ветка HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System) и возможные значения (в том числе значения по-умолчанию).

Ползунок User Account Control и соответствие параметров реестра (GPO)

Когда вы меняете уровень защиты UAC с помощью ползунка в панели управления, Windows изменяет значения следующих параметров реестра.

Таким образом, если вы хотите через GPO задать параметры UAC, соответствующие уровню ползунка вам достаточно настроить 3 параметра политик (указаны выше).

Например, для UAC уровень 3 (Notify only when programs try to make changes to my computer) нужно внедрить такие параметры в реестр:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"PromptOnSecureDesktop"=dword:00000001
"EnableLUA"=dword:00000001
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"EnableInstallerDetection"=dword:00000001
"EnableVirtualization"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"FilterAdministratorToken"=dword:00000000


Картинка с сайта: winitpro.ru

Значения параметров ConsentPromptBehaviorUser, EnableInstallerDetection, EnableVirtualization, ValidateAdminCodeSignatures и FilterAdministratorToken будут одинаковыми для всех уровней.

Как полностью отключить UAC в Windows через GPO?

Рассмотрим, как через групповые политики отключить контроль учетных записей в Windows.

На отдельном компьютере можно использовать редактор локальный групповой политики
gpedit.msc
. Если нужно применить политику на множестве компьютерлв в домене, нужно использовать консоль Group Policy Management Console —
gpmc.msc
(рассмотрим этот вариант).

1. В консоли управления доменными GPO щелкните по OU с компьютерами, на которых вы хотите отключить UAC и создайте новую политику
2. Отредактируйте политику и перейдите в разделComputer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options;
3. Для полного отключения UAC установите следующие значения параметров:
4. User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode =
   Elevate without prompting
   ;

• User Account Control: Detect application installations and prompt for elevation =
  Disabled
  ;
• User Account Control: Run all administrators in Admin Approval Mode =
  Disabled
  ;
• User Account Control: Only elevate UIAccess applications that are installed in secure locations =
  Disabled
  .
  

  Картинка с сайта: winitpro.ru

1. Чтобы обновить настройки групповых политик на компьютерах и отключить UAC, нужно перезагрузить их.

Также можно точечно отключать UAC только для некоторых пользователей/компьютеров через реестр, а настройки распространить через Group Policy Preferences.

Создайте новый параметр реестра в ветке GPO Computer Configuration -> Preferences -> Windows Settings -> Registry со следующими настройками:

• Action: Replace
• Hive: HKEY_LOCAL_MACHINE
• Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
• Value name: EnableLUA
• Value type: REG_DWORD
• Value data: 0

Картинка с сайта: winitpro.ru

Затем перейдите на вкладку Common и включите опции:

• Remove this item when it is no longer applied
• Item-Level targeting

Нажмите на кнопку Targeting и укажите компьютеры, или доменные группы, на которые должна применяться политика отключения UAC.

Вы можете изменить значение любого параметра из редактора реестра или из командной строки. Например, чтобы отключить UAC на компьютере (потребуется перезагрузка) можно выполнить команду:

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f.

Или аналогичная команда на PowerShell:

New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force

The Windows operating system is vulnerable to outside threats and unauthorized access, which is why it includes a User Account Control (UAC) feature.

Even if you are not aware of what UAC is, you must certainly have come across it if you are a Windows user. Ever seen that annoying confirmation dialog box that asks for administrative permission when you’re installing an app, running a setup, or uninstalling anything? That is the UAC prompt.

If it is getting too annoying for you and want to disable the UAC prompt, this article lists all the methods to do so on Windows 11. But before we show you how to do it, let us learn what it is, and whether it should be turned off or not.

What is User Account Control (UAC)

Картинка с сайта: www.itechtics.com

The UAC is a Windows security feature that prevents the unauthorized execution of apps and processes with administrative privileges and also prevents malicious software from running on your computer.

When an app or a program is making changes to your computer, a popup emerges asking for user consent, as in the image above.

In simpler words, it is just an extra precautionary measure by Windows to ensure that no task is run without the user’s consent, and thus, you are prompted with a dialog box for confirmation.

Is it Safe to Disable UAC?

Now that we know the role of UAC, disabling UAC is not the smart choice. Although most tasks performed by the end user, like installing or uninstalling an app, are done with complete consciousness, a UAC prompt gives a second chance to the user to reconsider their action.

Not only that but any malicious action performed by software or piece of code could also be blocked by the UAC. Additionally, any occurrences happening in the background would be highlighted and brought to the user’s attention with the help of the UAC prompt.

Therefore, we recommend that you do not disable the UAC, and only do it when it is necessary. After that, you can re-enable it.

UAC Security Levels

If you read ahead, you will find that the UAC has different security levels. each of those security levels defines how the UAC will work, when the end user will be prompted with a UAC, and when the prompt will not be generated.

Here are the details of the 4 security levels of UAC:

• Always notify

  A UAC prompt will appear when an app or a program tries to make changes to your system. It will also notify you when you try to change Windows settings. Additionally, it freezes background tasks until the user responds.

• Notify me only when apps try to make changes to my computer

  This is the default Windows UAC level and only notifies you when an app tries to install or make changes to your PC. It also freezes background tasks until you respond.

• Notify me only when apps try to make changes to my computer (do not dim my desktop)

  This option will display the UAC prompt but it does not freeze the background tasks, nor does it dim the desktop.

• Never notify

  Selecting this option completely disables the UAC. No prompts will pop up.

Let us now continue to see the different methods to disable UAC when needed.

Disable UAC on Windows

Disable UAC from Control Panel

The following steps allow you to disable the UAC from the Control Panel:

1. Press Windows Key + R to open the Run Command box.

2. Type in “Control” and press Enter to open the Control Panel.

3. Click “User Accounts.”

   

   Картинка с сайта: www.itechtics.com

4. Click “User Accounts” again.

   

   Картинка с сайта: www.itechtics.com

5. Click “Change User Account Control settings.”

   

   Картинка с сайта: www.itechtics.com

6. Drag the slider on the left to the bottom and click Ok.

   

   Картинка с сайта: www.itechtics.com

7. [Conditional] If UAC was already enabled, you will be prompted with a UAC. Click Yes.

UAC will now be disabled.

If you want to re-enable it again, simply return the slider inside the “Change User Account Control settings” page to its original UAC security level.

Картинка с сайта: www.itechtics.com

Disable UAC from Group Policy Editor

To disable the UAC prompts from the Group Policy editor, use these steps:

1. Press Windows Key + R to open the Run Command box.

2. Type in “gpedit.msc” and press Enter to open the Group Policy Editor.

3. Navigate to the following path from the left side of the Group Policy Editor:

   Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
   

4. Double-click the policy “User Account Control: Run all administrators in Admin Approval Mode” in the right pane.

   

   Картинка с сайта: www.itechtics.com

5. Select “Disabled” and then click Apply and Ok.

   

   Картинка с сайта: www.itechtics.com

6. Now press Windows Key + R again and type in “CMD“, then press CTRL + Shift + Enter to open the Command Prompt with elevated rights.

7. Execute the following command to implement the changes in the Group Policy Editor:

   GPUpdate /Force

   

   Картинка с сайта: www.itechtics.com

UAC will now be disabled.

However, if you want to enable it again, return to the “User Account Control: Run all administrators in Admin Approval Mode” Group Policy and enable it.

Disable UAC from Registry Editor

You can also disable the UAC from the Windows Registry Editor. Here is how:

1. Press Windows Key + R to open the Run Command box.

2. Type in “regedit” and press Enter to open the Registry editor.

3. Navigate to the following path from the left pane:

   Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
   

4. Double-click the DWORD “EnableLUA.”

   

   Картинка с сайта: www.itechtics.com

5. Change the Value Data to 0 and click Ok.

   

   Картинка с сайта: www.itechtics.com

6. Restart the computer.

Once the computer restarts, you will notice that the UAC has been disabled.

To re-enable it, return to the System key using the Registry Editor, double-click the DWORD “EnableLUA,” and set its Value Data to 1.

Disable UAC from Command Prompt

If you are a fan of the Command Line Interface (CLI), then you can also disable UAC directly from the Command Prompt with a single command. Here are the steps to follow:

1. Press Windows Key + R to open the Run Command box.

2. Type in “CMD” and then press CTRL + Shift + Enter to open the Command Prompt with elevated rights.

3. Run the following command:

   reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

   

   Картинка с сайта: www.itechtics.com

4. Now restart the computer.

The steps above will make changes to the EnableLUA DWORD in the Windows Registry and disable UAC.

To re-enable UAC, run the following command in an elevated Command Prompt:

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f

Disable UAC from Windows PowerShell

Similar to the Command Prompt, you can also disable UAC from PowerShell. Here is how:

1. Press Windows Key + R to open the Run Command box.

2. Type in “PowerShell” and then press CTRL + Shift + Enter to open PowerShell with elevated rights.

3. Run the following command:

   Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0

   

   Картинка с сайта: www.itechtics.com

4. Now restart the computer.

UAC will now be disabled when the computer restarts.

If you want to re-enable UAC, use this command in PowerShell:

Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 1

These are all the methods you can disable (or enable) UAC on a Windows computer. Let us now show you how to do the same on a remote computer that is on the same network.

Disable UAC Remotely

You can disable the User Account Control on a remote computer as well using the Command Prompt. This method can be used by sysadmins to get the task done without having to leave their computer.

To disable UAC on a remote PC, we must use PsTools by SysInternals – which is a suite of command-line tools for the Windows operating system. Using the PsExec utility inside this suite, you can remote access the Command Prompt of the target PC and then run any command.

Use the following steps to disable UAC on a remote computer:

1. Start by downloading and extracting PsTools.

   

   Картинка с сайта: www.itechtics.com

2. Launch an elevated Command Prompt and use the CD cmdlet to change the directory to the extracted folder:

   CD [PathToExtractedPsTools]

   

   Картинка с сайта: www.itechtics.com

3. Now use the following command syntax to connect to the remote computer:

   PsExec -i \\[RemoteComputerName] -u [Username] -p [Password] cmd

   Replace [RemoteComputerName] with the name of the PC you want to connect to, [Username] with the account name, and [Password] with the account password. Make sure that the account you are logging in with has administrative rights.

   

   Картинка с сайта: www.itechtics.com

   You will now be connected to the remote PC.

4. Now, use the following command to disable UAC on the remote PC:

   reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

   

   Картинка с сайта: www.itechtics.com

5. Now run the following command to restart the remote PC:

   Shutdown /r

   

   Картинка с сайта: www.itechtics.com

When the remote computer restarts, UAC will be turned off.

To re-enable it, you will need to use the PsExec tool again. Connect to the remote computer again using the command given above, and then use this command to re-enable UAC:

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f

Note that these are the exact same commands to disable or enable UAC on your local computer. This is because PsExec has launched a Command prompt instance on the remote computer and any commands running after establishing the connection will be on the remote PC.

Final Verdict

As mentioned earlier, it is not entirely safe to disable User Account Control. However, there are certain moments when it is absolutely necessary. That being said, we always recommend that you re-enable UAC when you no longer need it disabled.

This article lists multiple methods of disabling UAC on the local computer as well as on a remote computer on the same network.

User Account Control (UAC) is a default Windows security feature designed to prevent unwanted changes to the operating system. When a program tries to perform an action that requires administrator privileges, such as installing software or changing system settings, registry, or system files, UAC alerts the administrator and asks for confirmation. This reduces the risk of unauthorized changes and the execution of malicious code with administrator privileges.

In this article, we’ll look at how to manage UAC settings on a single computer, or multiple computers in a domain using Group Policies.

What does the UAC prompt look like? For example, if you attempt to elevate process privileges in a local administrator session, a UAC confirmation prompt appears:

User Account Control
Do you want to allow this app to make changes to your device?

Картинка с сайта: woshub.com

Configure User Account Control (UAC) Levels in Windows

To manage UAC settings in Windows, a special applet is available in the Control Panel, which can be launched from the classic Control Panel or with the UserAccountControlSettings.exe command.

Use the slider to change the User Account Control protection level on a computer. There are 4 predefined UAC levels available:

• Level 4 — Always notify — the highest UAC protection level;
• Level 3 — Notify only when programs try to make changes to my computer (default) – default protection level (used by default);
• Level 2 — Notify only when programs try to make changes to my computer (do not dim my desktop) – almost the same as the previous level, but without switching to Secure Desktop with desktop locking;
• Level 1 — Never notify – UAC is disabled.

Картинка с сайта: woshub.com

Note that moving the slider to the bottom Never notify (Level 1) position doesn’t completely disable UAC. This mode only enables automatic confirmation of administrator elevation requests without displaying the UAC prompt. Elevation requests are automatically denied in non-admin user sessions.

To disable UAC completely, you must disable the local group policy option User Account Control: Run all administrators in Admin Approval Mode. See below for details.

Managing UAC Settings via Group Policy

It is possible to manage UAC settings in Windows through Group Policy. The names of the UAC-related Group Policy options begin with User Account Control and can be found in this GPO editor section Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options.

Картинка с сайта: woshub.com

The following table contains a list of UAC policies, their possible values (including defaults), and the corresponding registry parameters (located under the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System registry key).

User Account Control Slider Levels and GPO/Registry Settings

When you change the UAC protection level by using the slider in the Control Panel, Windows changes the values of the following registry entries.

Therefore, if you want to use the GPO to configure UAC settings that correspond to the specific slider level, you only need to configure 3 policy parameters (described above).

For example, apply the following registry parameters to set UAC level 3:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"PromptOnSecureDesktop"=dword:00000001
"EnableLUA"=dword:00000001
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"EnableInstallerDetection"=dword:00000001
"EnableVirtualization"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"FilterAdministratorToken"=dword:00000000

Картинка с сайта: woshub.com

The values of the ConsentPromptBehaviorUser, EnableInstallerDetection, EnableVirtualization, ValidateAdminCodeSignatures, and FilterAdministratorToken parameters are the same for all levels.

There is another registry parameter in this key, LocalAccountTokenFilterPolicy, often referred to as Remote UAC. This parameter restricts remote connections to default admin shares under local user accounts with administrator privileges.

How to Disable UAC with Group Policy

Let’s look at how to completely disable User Account Control (UAC) in Windows through Group Policy.

On a standalone computer, use the Local Group Policy Editor gpedit.msc. If you need to deploy the Group Policy settings to multiple domain computers, use the Group Policy Management Console – gpmc.msc (let’s consider this option).

1. In the Group Policy Management snap-in, click the OU containing computers where you want to disable UAC and create a new GPO
2. Edit the policy and go to the section Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options;
3. To completely disable UAC, set the following parameter values:
   • User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode = Elevate without prompting;
   • User Account Control: Detect application installations and prompt for elevation = Disabled;
   • User Account Control: Run all administrators in Admin Approval Mode = Disabled;
   • User Account Control: Only elevate UIAccess applications that are installed in secure locations = Disabled.
     

     Картинка с сайта: woshub.com

4. Reboot the target computers to update Group Policy settings and disable UAC. After the reboot, UAC will switch to “Never notify” mode.

You can also disable UAC for some users/computers via the registry and deploy the settings through Group Policy Preferences.

In the GPO editor, go to Computer Configuration -> Preferences -> Windows Settings -> Registry and create a new registry parameter with the following settings

• Action: Replace
• Hive: HKEY_LOCAL_MACHINE
• Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
• Value name: EnableLUA
• Value type: REG_DWORD
• Value data: 0

Then go to the Common tab and enable the options:

• Remove this item when it is no longer applied
• Item-Level targeting

Click the Targeting button and specify the computers or domain security groups to which you want to apply the UAC disable policy.

You can change the value of any parameter using the Registry Editor GUI or from the command prompt. For example, to disable UAC on a computer (a reboot is required), run the command:

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f.

Or a similar PowerShell command:

New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force