locked
UAC: Elevate without prompting: does it really disable all UAC ? RRS feed

  • Question

  • Hello,

    Referring to another question which has been answered regarding disabling AAM triggers de facto the disable of UAC, (this Article),

    It is still unclear to me what is the consequence of having AAM activated with the setting prompt for administrators in Admin Approval Mode policy setting is set to Elevate without prompting

    The following technet Article is confusing:

    On the beginning we have the following recommendation:

    "If UAC is disabled to avoid the elevation prompt, all UAC functionality is disabled. Instead, consider configuring UAC to elevate without prompting. In this case, applications that have been marked as administrator applications, as well as setup applications, will automatically run with the full administrator access token. All other applications will automatically run with the standard user token. The additional functionality of UAC is maintained."

    Then later on same page:

    "The Elevate without prompting setting turns UAC off. This setting should be used only on a domain controller or server for advanced users or server administrators. This setting should not be applied to a client computer."

    My objective is to keep UAC active while i do not want any notification or approval requested when a user part of local admin group wants to install a new software on his computer. We have teams constantly deploying software they need to test on Windows 7, and they are bothered by UAC prompts when installing software.




    • Edited by Kipik Friday, October 12, 2012 12:21 PM
    Friday, October 12, 2012 12:14 PM

Answers

  • Hi,

    The above policy when set to ‘elevate without prompt’ it will be equivalent to turning off the UAC only for administrators and is not related to the non admin users.

    The Elevate without prompting setting turns UAC off. This setting should be used only on a domain controller or server for advanced users or server administrators. This setting should not be applied to a client computer.

    Alex Zhao

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.


    Alex Zhao

    TechNet Community Support

    • Marked as answer by Cloud_TS Friday, October 26, 2012 2:03 AM
    Monday, October 15, 2012 3:03 AM
  • the "explain" tab for these Group policies gives a nice explanation for these settings. As per my understanding, "Elevate without prompting" setting for the GP, "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" only turns off UAC for admin users.

    For normal users, we have a different GP to govern the settings.


    Janaki Hariharan

    • Marked as answer by Cloud_TS Friday, October 26, 2012 2:03 AM
    Monday, October 15, 2012 12:24 PM

All replies

  • Hi,

    The above policy when set to ‘elevate without prompt’ it will be equivalent to turning off the UAC only for administrators and is not related to the non admin users.

    The Elevate without prompting setting turns UAC off. This setting should be used only on a domain controller or server for advanced users or server administrators. This setting should not be applied to a client computer.

    Alex Zhao

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.


    Alex Zhao

    TechNet Community Support

    • Marked as answer by Cloud_TS Friday, October 26, 2012 2:03 AM
    Monday, October 15, 2012 3:03 AM
  • the "explain" tab for these Group policies gives a nice explanation for these settings. As per my understanding, "Elevate without prompting" setting for the GP, "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" only turns off UAC for admin users.

    For normal users, we have a different GP to govern the settings.


    Janaki Hariharan

    • Marked as answer by Cloud_TS Friday, October 26, 2012 2:03 AM
    Monday, October 15, 2012 12:24 PM