User Account Control was introduced with Vista to tighten down security in Windows. It's been there ever since and has been slightly tweaked in Windows 7 and updated again in Windows 8. The basic idea for UAC is to run even administrative users as regular users and explicitly ask for rights elevation when a task that requires administrative rights is performed.

Most of the time this works just fine, but it can be pretty annoying. I can't tell you how often I've worked with customers who needed to perform some sort of configuration task on their machine, who *think* and vehemently insist that they are running as an Admin user, when in fact they are not. For example, try registering a COM object using regsvr32.exe when you're running as UAC limited user and see what happens - a whole lot of nothing is what!

The problem is that elevation only works if the application in question actually prompts for elevation, which many older applications do not, or if you explicitly elevate with Run As Administrator. For automatic elevation prompts, an application has to have a manifest that requests elevation to administrative rights - otherwise the app runs blissfully in standard user mode thinking it has full rights.

In other words UAC can be a real pain in the ass if you REALLY, REALLY need to run as an Administrator. Microsoft has obfuscated the real Administrator features that it's a real pain to circumvent UAC when required. Worse - Microsoft in their infinite wisdom decided to also impart UAC on us on server operating systems where Administrative tasks are even more common and UAC is even more of a pain than on user PC.

Disclaimer: if you decide to remove User Account Control restrictions on your machine, do so with caution and understand that you are making your computer less secure. Overall UAC is a good idea and should be enabled - only remove this functionality for special cases and then reset it. I take no responsibility for your security issues that might arise by turning it off. You've been warned.

Windows 8 and User Account Control

On Windows 8 and Server 2012 Microsoft has stepped UAC up another notch by essentially making it impossible to turn UAC off through the User Interface - while in Vista and 7 you were able to just move the slider down to turn UAC off in Windows 8 that's not possible through the UI. If you slide the slider down all the way you only get the 'Don't bug me' mode which doesn't prompt you and just silently elevates every request.

To get to the built-in UAC dialog go to the Start Screen and type User Account Settings. Look on the Settings tab for Change User Account Settings and you get this screen.

As mentioned this does NOT turn off User Account Control completely, it just hides the administration prompts if your account is an Administrator account.

Windows 8 Store Apps will not run with User Account Control off

Presumably the reason for the inability to completely turn off UAC is that Windows Store apps won't run when UAC is off. If you turn it off (as I describe below) Windows Store Apps will simply not launch. You get a

This App can't open dialog

For most of us on the desktop this is probably not a problem. Since installing Windows 8 a year ago I haven't used a single Windows Store App other than just poking around to see what's there and it didn't motivate me in any way. This even though I have a touch desktop monitor and a touch laptop and I still prefer using desktop apps over the Metro ones by a long shot.

But keep this limitation in mind if you decide to follow the instructions below.

No really - turn User Account Control off!

So if you're still here and you REALLY want to turn off User Account Control in Windows 8 - at your own risk mind you - here's how you do it.

You can still do it by setting the Machine Group Policy. User Account Control is basically administered through group policy and buried in the myriad of group policy settings there are a handful of settings that apply to User Account Control. Using these settings you can tweak the behavior of User Account Control, such as turning on or off file virtualization and a few other things. There's also a single value you can use to turn User Account Control off completely:

The key is:

Local Computer Policy | Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options | User Account Control: Run all administrators in Admin Approval Mode.

Admin Approval mode is what makes Administrators run as standard users and turning this single flag turns UAC off. Basta!

Notice that there are a bunch of other settings you can tweak if you want to be a little less intrusive but really if you are going to bother with this, the only thing that really makes sense here is turning on and off.

Making changes to User Account Control - both here and in the UAC user interface require that you reboot as these are system wide changes that affect all users. A full reboot (not just log-off/on) is required.

Be Safe - Don't leave it off

Again I want to point out that this is not something you should not leave set permanently. Switch it off if you're working with something that requires elevated rights extensively or as the case for me where several strung together operation cause problems. Then when you're done put it back.

Here to stay…

User Account Control is here to stay and I suspect at some point in the future Microsoft will disable the option to turn it off completely. Until then you can still tweak the group policy to circumvent it if absolutely necessary.