UAC (User Account Control) is the Windows security feature that makes every program run with standard user rights by default, even when the signed-in person is an administrator, and that requires an explicit consent or credential prompt before a process receives a full administrator token. Introduced with Windows Vista and present in every later release, it is one of the foundational mechanisms of Windows security.
UAC implements the principle of least privilege on the desktop. It limits what malware can do silently, forces software vendors to avoid unnecessary administrator requirements, and makes elevation a visible, deliberate act. It is, however, a convenience and defense-in-depth feature rather than a strict security boundary, a distinction that matters when assessing its protection.
How UAC splits administrator rights
When a member of the local Administrators group signs in, Windows creates two access tokens. The filtered token has the Administrators group marked deny-only and most powerful privileges removed; the full token keeps everything. Explorer and all programs started normally run with the filtered token. This arrangement is called Admin Approval Mode.
Elevation is handled by the Application Information service, which shows the prompt and, after approval, starts the requested process with the full token. Each process also carries an integrity level, part of Mandatory Integrity Control, which prevents lower-integrity processes from writing to higher-integrity objects.
| Integrity level | Typical processes | Restriction |
|---|---|---|
| Low | Sandboxed browser renderers, protected mode content | Cannot write to most user files or registry keys |
| Medium | Normal applications with the filtered token | Cannot modify system-wide locations |
| High | Elevated administrator processes | Full administrative access |
| System | Services and core operating system components | Highest level used by the operating system |
User Interface Privilege Isolation (UIPI) complements integrity levels by blocking a medium-integrity process from sending most window messages to an elevated window. This stops simple input injection attacks that would otherwise click the prompt or drive an elevated tool.
Prompt types and the secure desktop
UAC shows two different prompts depending on the account. An administrator sees a consent prompt with Yes and No buttons, while a standard user sees a credential prompt that requires an administrator name and password, a PIN or another Windows Hello method.
By default the prompt appears on the secure desktop, a separate, dimmed desktop that only trusted system processes can access. This protects the decision from spoofing and from automated clicks by other software. The color and wording of the prompt also tell the user whether the program is signed by Windows, signed by a verified publisher or unsigned.
| Slider level | Behavior | Secure desktop |
|---|---|---|
| Always notify | Prompts for app installs and Windows setting changes | Yes |
| Notify for app changes (default) | Prompts only when apps request elevation | Yes |
| Notify without dimming | Same as default but on the normal desktop | No |
| Never notify | Elevates administrators silently | Not used |
The default level lets certain signed Windows binaries auto-elevate without a prompt. That convenience is the root of many known UAC bypass techniques, which is why security baselines recommend the Always notify level on sensitive machines.
How applications interact with UAC
An application declares its needs in its manifest through the requestedExecutionLevel element. Correct manifests are the main way developers make software work cleanly under UAC.
| Manifest value | Behavior | Appropriate for |
|---|---|---|
| asInvoker | Runs with the caller’s token | Most applications |
| highestAvailable | Elevates if the user is an administrator | Tools useful for both user types |
| requireAdministrator | Always requests elevation | Installers and system utilities |
For older programs without a manifest that try to write to protected locations, UAC applies file and registry virtualization: writes to folders such as Program Files are silently redirected to a per-user VirtualStore. Virtualization is a compatibility measure only and does not apply to 64-bit or manifested applications.
UAC compared with related Windows protections
UAC is one layer in a broader set of Windows security controls. It decides when a process may receive administrator rights, while other features decide what code may run or how credentials are protected.
| Feature | Main question it answers | Relationship to UAC |
|---|---|---|
| UAC | May this process run with administrator rights | Baseline elevation control |
| Smart App Control | Is this application trustworthy enough to run | Acts before any elevation |
| Credential Guard | Can secrets be stolen from memory | Protects credentials even after elevation |
| Windows LAPS | Is each local administrator password unique | Reduces damage when admin credentials leak |
| Windows Sandbox | Can untrusted software run in isolation | Separates risky code from the host |
Newer Windows 11 releases add Administrator protection, which uses a separate, system-managed isolated account for elevation and requires Windows Hello authentication. It is designed to close the gap left by the shared-profile model of classic Admin Approval Mode.
Configuration choices and common mistakes
Administrators configure UAC through Group Policy security options or Intune, under the User Account Control policy names. The underlying registry value EnableLUA switches Admin Approval Mode on or off for the whole system.
- Disabling UAC entirely turns off Admin Approval Mode, gives every administrator process a full token and breaks modern packaged apps; it is never a good fix for an annoying prompt.
- Daily work with an administrator account leaves users one click away from elevation; a separate standard account is the stronger setup.
- Treating UAC as a security boundary is a misconception, because Microsoft does not service every bypass as a vulnerability.
- Remote UAC filtering strips administrator rights from local accounts over the network; disabling it with LocalAccountTokenFilterPolicy widens lateral movement risk.
- Ignoring publisher information in the prompt removes the main signal that an elevation request is legitimate.
Explained without jargon
Even if you are the administrator of your computer, Windows does not let every program use your full power. Programs start with ordinary rights. When one needs to change the system, such as installing a driver, Windows dims the screen and asks you first.
That question is UAC. It works like a door that locks behind you. You still hold the key, but you must use it on purpose each time. A prompt you did not expect is a warning sign.
A typical use case
An accounting office of twelve people moves all employees from administrator accounts to standard user accounts and sets UAC to Always notify. The IT contractor keeps a separate administrator account, and Windows LAPS manages unique local administrator passwords on every computer.
A month later, an employee opens a malicious attachment that tries to install a persistence service. The program runs with standard rights, triggers a credential prompt the employee cannot satisfy, and fails to install. The incident ends with a deleted file and a quick scan instead of a compromised workstation, and the contractor uses the event logs to confirm that no elevation occurred.