Is the UAC level in Windows per individual user?

Can each user have different UAC level in a PC? Specifically, can an Admin have UAC level set to "never notify" and a User have UAC level set to "always notify" and so on?

winman

Posted 2012-12-05T13:03:00.577

Reputation: 179

Answers

The UAC level is a machine wide setting. So it cannot be set per-user.

David Heffernan

Posted 2012-12-05T13:03:00.577

Reputation: 1 153

A late correction: the "never notify" setting used to turn UAC off entirely, but IIRC no longer does. – Harry Johnston – 2019-02-15T22:39:50.423

1But can user and admin can have different UAC level? Please see my comment above.thank you. – None – 2012-12-06T05:45:21.547

Hard to believe for a setting stored in HKLM. So, I've no idea what you did in your experiment, but it doesn't hang true. You must remember that UAC is very different for users and admin. For a user, there is no consent dialog. For a user there's either no UAC, or the over the shoulder dialog for every process that requires elevation. – David Heffernan – 2012-12-06T07:38:24.760

I think my question made everyone confusing.All user have same UAC level in my PC. But admin is in different UAC level.Is this possible? – winman – 2012-12-06T08:12:52.030

@winman no, this is not possible. For users, the slider is useless, it only effects members of the admin group. – magicandre1981 – 2012-12-06T08:28:29.810

@magicandre1981 What do you mean by slider is useless for user.I know that User cannot change UAC level,only admin can change it.But can admin set diffeent UAC level for him(admin) and user( for all user accounts it will be same)? – winman – 2012-12-06T09:15:57.857

the setting has no effect for members of the user group. The UAC only effects members of the admin group. Standard users don't have the 2 tokens and use Over-the-shoulder (OTS) elevation to get elevated permission by entering an username and password from a member of the admin group. – magicandre1981 – 2012-12-06T13:15:53.490

@magicandre1981: that's not quite true. The "never notify" setting turns UAC off entirely, which does affect standard users; for example, it prevents them from using OTS elevation, and it prevents Internet Explorer from using Protected Mode. You can get finer control over this using Group Policy. – Harry Johnston – 2012-12-09T23:53:22.477

yes, because this completely disables UAC. i was only talking about the 3 levels with still left UAC on. I forgot to mention this. – magicandre1981 – 2012-12-10T20:03:11.733

It sounds as if you want to make it so that elevation occurs silently for admin users but standard users can still enter a password to be elevated.

If your edition of Windows supports Group Policy, you can do this. First, use the control panel GUI to restore the "Always Notify" setting.

Using gpedit.msc, go to Local Computer Policy: Computer Configuration: Windows Settings: Security Settings: Local Policies: Security Options.

Set "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Elevate without prompting".

Reboot.

It is probably possible to do the same thing via the registry on Windows editions that don't support group policy, but I don't know how to do this.

Harry Johnston

Posted 2012-12-05T13:03:00.577

Reputation: 5 054

The setting is written in the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System path inside the registry. So it is an system wide setting.

I belive, that in the Professional+ version of Windows you can define the setting using gpedit.msc, which should allow different settings per user.

Daniel Fuchs

Posted 2012-12-05T13:03:00.577

Reputation: 31

1Why would the ability to modify using gpedit mean that the setting became per user? – David Heffernan – 2012-12-05T14:02:08.370

Thank u Daniel for your reply.But what i wanted to know is about UAC levels.(Always notify,Notify me only when programs try to make changes to my computer,Notify me only when programs try to make changes to my computer,Never notify).My doubt is For example can admin have UAC level as never notify and user as "always notify".It can be any level but should be different for admin and user.Is this possible? (In one of my PC when i view UAC window it was in different level in admin and user account) – None – 2012-12-05T14:02:37.913

1Just now i tried creating a administrator account with UAC level never notify and then i created user account(standard user) for which i gave "always notify".but when i create one more user account(standard user) it's UAC level was set to "always notify". Now if i change any of one of two user accounts UAC level the other users UAC level changes automatically.If i change UAC level of admin it does not cause change to UAC level of user and vice versa!!.So does user and admin can have different UAC level? – None – 2012-12-05T14:26:54.540

The relevant group policy settings are under Computer Configuration, so they cannot be defined per-user. However, there are three distinct settings: one applies to the built-in Administrator account, one to all other admin accounts, and one to all standard user accounts. – Harry Johnston – 2012-12-09T23:42:03.010

@winman: in Windows 7, at least, the UAC control panel won't even start up for a standard user account when UAC is turned off, so what exactly do you mean when you say the standard user's UAC level was set to always notify? – Harry Johnston – 2012-12-09T23:55:09.917