User Account Control (UAC)

User Account Control (UAC) is a security feature introduced in Windows Vista and present in all subsequent versions, including Windows 10 and Windows 11. Its primary purpose is to prevent unauthorized changes to the operating system by requiring explicit permission from an administrator before allowing actions that could affect system security or stability. UAC helps mitigate the impact of malware by ensuring that even if a user is logged in with an administrative account, most processes run with standard user privileges unless elevated. This concept is known as the "least privilege" principle.

Before UAC, Windows users often ran with full administrative privileges, which meant that any application, including malware, had complete control over the system. UAC was designed to reduce the attack surface by running most applications with standard user privileges, even if the user is an administrator. When an action requires administrative rights, UAC prompts the user for consent (if they are an administrator) or for credentials (if they are a standard user). This prompt is known as the "UAC elevation prompt."

UAC operates through a mechanism called "token filtering." When a user logs on, Windows creates an access token that contains the user's security identifiers (SIDs) and privileges. If the user is a member of the Administrators group, Windows creates two separate tokens:

When a process attempts to perform an action that requires administrative rights (e.g., writing to the Program Files folder, modifying system registry keys, or installing drivers), the system checks the token. If the process is running with a filtered token, the action is denied, and the system triggers a UAC prompt.

The UAC prompt appears in one of two forms depending on the user account type:

By default, the UAC prompt appears on the secure desktop, which is a separate, isolated desktop that prevents other applications from interfering with the prompt. This prevents malware from simulating clicks or capturing the prompt.

Windows provides four UAC notification levels, configurable via the "User Account Control Settings" applet:

UAC virtualization is a compatibility feature that redirects write attempts to protected system locations (e.g., Program Files, HKEY_LOCAL_MACHINE\Software) to a per-user virtual store. This allows legacy applications that expect to write to these locations to function without requiring elevation. The virtual store is located at:

Virtualization is only applied to 32-bit applications that do not have a requested execution level (as defined in the manifest). It is not applied to 64-bit applications or applications that explicitly request elevation.

Applications can declare their required execution level in a manifest file. The manifest includes a requestedExecutionLevel element with one of three values:

If an application does not have a manifest, Windows applies heuristics to determine whether to prompt. For example, if the application's name contains words like "setup" or "install", Windows may automatically prompt for elevation.

UAC can be configured via Group Policy under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. Key policy settings include:

When running commands from an elevated command prompt, the prompt is titled "Administrator: Command Prompt." To run a command as administrator from a non-elevated prompt, use the runas command:

runas /user:Administrator "cmd.exe"

Alternatively, right-click the command prompt icon and select "Run as administrator."

PowerShell also respects UAC. To run a script that requires elevation, you must start PowerShell as administrator. You can check if the current session is elevated using:

[System.Security.Principal.WindowsPrincipal]::new([System.Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)

This returns True if elevated, False otherwise.

UAC does not apply to remote desktop connections in the same way. By default, Remote Desktop users are assigned a filtered token, but UAC prompts are not displayed on the remote session. Instead, remote administration tools like psexec can bypass UAC if run with the -s flag (system account). This is a common attack vector.

Common issues include:

To verify UAC status from the command line, use:

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA

A value of 1 means UAC is enabled; 0 means disabled.

In an enterprise environment, UAC is a critical layer of defense against malware and unauthorized system changes. For example, a company deploys Windows 10 workstations for its employees. The IT department configures UAC via Group Policy to enforce the highest notification level on all user workstations. This ensures that any attempt to install software or change system settings triggers a UAC prompt. Help desk staff are trained to recognize legitimate UAC prompts and to verify that users are not blindly clicking 'Yes' to malicious prompts. In this scenario, UAC helps prevent ransomware from encrypting system files by requiring explicit elevation for any write operations to protected directories. Another common scenario is in a software development environment where developers need to test applications that require administrative privileges. The IT team configures UAC to prompt for credentials for standard users, so developers must enter an admin account's credentials to run elevated tests. This prevents accidental system changes while still allowing necessary development work. A misconfiguration that often occurs is disabling UAC entirely to reduce user frustration. This is a serious security risk because it removes the protection against unauthorized system changes. In one case, a company experienced a malware outbreak because UAC was disabled on all workstations, allowing the malware to install itself without any prompts. The fix involved re-enabling UAC via Group Policy and retraining users to expect and respond to prompts. Performance considerations: UAC prompts can cause a slight delay (1-2 seconds) when an elevation is requested, but this is negligible on modern hardware. The secure desktop switch can cause a brief screen flicker, which is normal. At scale, managing UAC via Group Policy is straightforward and consistent across thousands of machines.