How to prohibit standard users performing administrative tasks having typed administrative passwords?

Question

In Windows 10, if a user on a standard account attempts to perform a task that requires administrative privileges, they are asked to type in a password of an administrative account, on behalf of which they may perform this task, provided they type in the password correctly.

Is there any way to prevent this behavior, that is, to prohibit standard users from performing administrative tasks and prevent them from being asked for an administrative password? So that they cannot perform administrative tasks no matter what, as long as they're logged into a standard account?

Answer 1

Is there any way to prohibit standard users from performing administrative tasks?

and prevent them from being asked for an administrative password?

Yes this is possible using the Security Policy Editor (secpol).

See the instructions below.

Note:

• Although the instructions are aimed at Windows 7 that particular group policy is also available on a Windows 10 Pro machine.

---

Hide User Account Control prompts for non-administrative users

Follow these steps to eliminate UAC prompts for standard users:

• Click on the start menu, type "secpol.msc" and hit Enter.

• When the "Local Security Policy" editor ("snap-in") opens, double-click on "Local Policies" -for those affecting this particular machine- and double-click on "Security Options".

• Scroll down until you see a node labeled "User Account Control: Behavior of the Elevation Prompt for Standard Users" (careful, another policy starts with the same name, but actually affects computer administrators!) Double-click on it and the following dialog will open:

  

• The default behavior for standard users, selected in the dropdown menu pictured above, is "Prompt for credentials": whenever elevated privileges are required, they'll need to select an administrator and enter its password in a UAC prompt to proceed with the action.

• Click on the dropdown, and select the "Automatically deny elevation requests" option instead; click "OK" to apply the new setting: from this point on, standard users won't event get a UAC prompt when they attempt any task that needs administrative permissions.

Note that this setting takes effect immediately, so make sure that you and/or someone else does have the full administrator credentials, which will sooner or later be needed to logon to that computer. While this is a very secure setting, that eliminates possibilities even for those who have admin name and password, it can also become very impractical, especially for advanced "power" users, who'll find their computing experience quite frustrating! Be sure to see how you can also hide usernames and only show blank text boxes on the Windows 7 logon screen for an even safer computer.

Source Prevent standard users from getting the Windows 7 UAC / administrator password prompt