Rick Strahl's Weblog  

Wind, waves, code and everything in between...
.NET • C# • Markdown • WPF • All Things Web
Contact   •   Articles   •   Products   •   Support   •   Advertise
Sponsored by:
West Wind WebSurge - Rest Client and Http Load Testing for Windows

Disable User Account Control On Windows 8


:P
On this page:

User Account Control was introduced with Vista to tighten down security in Windows. It's been there ever since and has been slightly tweaked in Windows 7 and updated again in Windows 8. The basic idea for UAC is to run even administrative users as regular users and explicitly ask for rights elevation when a task that requires administrative rights is performed.

Most of the time this works just fine, but it can be pretty annoying. I can't tell you how often I've worked with customers who needed to perform some sort of configuration task on their machine, who *think* and vehemently insist that they are running as an Admin user, when in fact they are not. For example, try registering a COM object using regsvr32.exe when you're running as UAC limited user and see what happens - a whole lot of nothing is what!

The problem is that elevation only works if the application in question actually prompts for elevation, which many older applications do not, or if you explicitly elevate with Run As Administrator. For automatic elevation prompts, an application has to have a manifest that requests elevation to administrative rights - otherwise the app runs blissfully in standard user mode thinking it has full rights.

In other words UAC can be a real pain in the ass if you REALLY, REALLY need to run as an Administrator. Microsoft has obfuscated the real Administrator features that it's a real pain to circumvent UAC when required. Worse - Microsoft in their infinite wisdom decided to also impart UAC on us on server operating systems where Administrative tasks are even more common and UAC is even more of a pain than on user PC.

Disclaimer: if you decide to remove User Account Control restrictions on your machine, do so with caution and understand that you are making your computer less secure. Overall UAC is a good idea and should be enabled - only remove this functionality for special cases and then reset it. I take no responsibility for your security issues that might arise by turning it off. You've been warned.

Windows 8 and User Account Control

On Windows 8 and Server 2012 Microsoft has stepped UAC up another notch by essentially making it impossible to turn UAC off through the User Interface - while in Vista and 7 you were able to just move the slider down to turn UAC off in Windows 8 that's not possible through the UI. If you slide the slider down all the way you only get the 'Don't bug me' mode which doesn't prompt you and just silently elevates every request.

To get to the built-in UAC dialog go to the Start Screen and type User Account Settings. Look on the Settings tab for Change User Account Settings and you get this screen.

UAC Dialog

As mentioned this does NOT turn off User Account Control completely, it just hides the administration prompts if your account is an Administrator account.

Windows 8 Store Apps will not run with User Account Control off

Presumably the reason for the inability to completely turn off UAC is that Windows Store apps won't run when UAC is off. If you turn it off (as I describe below) Windows Store Apps will simply not launch. You get a

This App can't open dialog

For most of us on the desktop this is probably not a problem. Since installing Windows 8 a year ago I haven't used a single Windows Store App other than just poking around to see what's there and it didn't motivate me in any way. This even though I have a touch desktop monitor and a touch laptop and I still prefer using desktop apps over the Metro ones by a long shot.

But keep this limitation in mind if you decide to follow the instructions below.

No really - turn User Account Control off!

So if you're still here and you REALLY want to turn off User Account Control in Windows 8 - at your own risk mind you - here's how you do it.

You can still do it by setting the Machine Group Policy. User Account Control is basically administered through group policy and buried in the myriad of group policy settings there are a handful of settings that apply to User Account Control. Using these settings you can tweak the behavior of User Account Control, such as turning on or off file virtualization and a few other things. There's also a single value you can use to turn User Account Control off completely:

UserAccountPolicy

The key is:

Local Computer Policy | Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options | User Account Control: Run all administrators in Admin Approval Mode.

Admin Approval mode is what makes Administrators run as standard users and turning this single flag turns UAC off. Basta!

Notice that there are a bunch of other settings you can tweak if you want to be a little less intrusive but really if you are going to bother with this, the only thing that really makes sense here is turning on and off.

Making changes to User Account Control - both here and in the UAC user interface require that you reboot as these are system wide changes that affect all users. A full reboot (not just log-off/on) is required.

Be Safe - Don't leave it off

Again I want to point out that this is not something you should not leave set permanently. Switch it off if you're working with something that requires elevated rights extensively or as the case for me where several strung together operation cause problems. Then when you're done put it back.

Here to stay…

User Account Control is here to stay and I suspect at some point in the future Microsoft will disable the option to turn it off completely. Until then you can still tweak the group policy to circumvent it if absolutely necessary.

Posted in Windows  

The Voices of Reason


 

Donatas
October 01, 2013

# re: Disable User Account Control On Windows 8

It's really hardly possible for a developer to live with UAC `on` on a development machine.
- When web project is configured to run on IIS VS needs to run as admin explicitly but then you can't drag'n'drop things on to it (security context differences)!
- Can't edit `hosts` file easily
- Get security prompts when changing something in program files

The first item is basically enough for me to always have it off.

Rick Strahl
October 02, 2013

# re: Disable User Account Control On Windows 8

@Donatas - Agree with you. For #1 IISExpress is an option and you can always launch Visual Studio with RUn as Admin which works. File editing of some files is a bitch - you have to launch editors using Run As then drop files into editors - it all comes down to some inconveniences vs. security.

Hey, where have I heard that before??? Sounds state propaganda around here :-)

Ruben Bartelink
October 02, 2013

# re: Disable User Account Control On Windows 8

>User Account Control is here to stay and I suspect at some point in the future Microsoft will turn it off completely

I think you want to word that a little tighter - in what sense do you mean 'turn it off completely' -- UI etc. ? (or maybe you don't)

Rick Strahl
October 02, 2013

# re: Disable User Account Control On Windows 8

@Ruben - LOL - yup missed a couple of words there. Cleaned up thanks.

Jackie
October 03, 2013

# re: Disable User Account Control On Windows 8

Since Windows Vista when I've discovered the UAC feature I've turned off from the 1st day of use :). Then Windows 7 was launched and the same annoying UAC and still turned off. In my opinion this is the most useless feature from Windows.

I prefer having a good antivirus installed rather than keeping UAC turned off and at each step to prompt me if I want to allow or disallow an action.

In Vista and Windows 7 I've worked with UAC turned off and I had no problems with my computer.
With Windows 8, Microsoft tries to force us to keep UAC turned off even we don't want to do this.

I work as a tester and sometimes having the UAC turned on, slows down the advancement with the tests that I have to perform. Also when I have to prepare a testing environment, the UAC keeps playing tricks with me.

balajig
November 22, 2013

# re: Disable User Account Control On Windows 8

Is there anyway i can just set "Run all administrators in admin approval mode" as disabled and still make the store apps work fine?

Rick Strahl
November 22, 2013

# re: Disable User Account Control On Windows 8

@balajib - I don't think so. As soon as you are a true admin Store apps no longer work. I suspect this breaks Microsoft's Store security model and so they can't allow that.

I've resigned myself to run with UAC on and have notifications off, but there are still a million little things that don't work and require explicitly launching of admin command prompts or elevating individual apps.

Jane
August 07, 2014

# re: Disable User Account Control On Windows 8

Hallo!
nice atricle. I just wondering if you do it the same way in windows 8 like it mentioned at this site.
http://www.excel-aid.com/sign-out-of-a-user-account-in-windows-8-how-and-why.html

West Wind  © Rick Strahl, West Wind Technologies, 2005 - 2024