Windows 10 – UAC Keeps Resetting on Windows 10

group-policyuacwindows 10windows-registry

I have a Windows10 Enterprise machine on which I want to disable UAC completely in order to execute all applications as Administrator per default.

However, my UAC settings keep resetting every time after a reboot.

I tried the following solutions:

Setting the following values in the registry hive HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System:
- EnableLUA to 0
- ConsentPromptBehaviorAdmin to 0
I even made myself the effective owner of the registry hive above and denied every other user (incl. SYSTEM) to modify it.
Setting the following group policies:
- Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Behavior of the elevation prompt for adminsitrators in Admin Approval Mode to Elevate without promting
- Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Run all administrators in Admin Approval Mode to Disabled
- There is an other setting somewhere around Computer Configuration\Administrative Templates\System\ ??? which disables the automatic overriding of Group Policy Settings.
Reinstalling a fresh copy of Windows10
Writing a script in C# executed on every boot which sets all these settings for me – it did not work as not even Admin Privileges apparently are high enough to change these settings…

None of the above solutions –including the Windows re-installation– helped resolving the problem.

I am aware that Windows10 has trouble running the WindowsStore and MSEdge etc. when one has UAC completely disabled – but I do not care as I do not use any of these "features".

Does anyone have a solution which I have maybe not yet tried?

As a developer, this drives me completely nuts.

Edit:

Completely disable UAC in Windows 10 is not a duplicate of my question, as I have tested all the proposed solutions in the linked question and they did not work for me (as specified above).

Best Answer

Open gpedit.msc and navigate to Computer configuration -> Windows settings -> Security settings -> Local policies -> Security options. Under that, disable User Account Control:Run all administrators in Admin Approval Mode.

Here's what the documentation for Admin approval mode says:

If a computer is upgraded from a previous version of the Windows operating system, and the administrator account is the only account on the computer, the built-in administrator account remains enabled, and this setting is also enabled.

This is indeed the case for me - I have upgraded from Windows 7 Ultimate -> 8.1 -> 10, and mine is the sole administrator account. If that's the case for you too, well - seems this can't be fixed without a fresh install of Windows with a separate administrator account.

Related Solutions

Windows – Device manager access for non admins

Try this im Curious.

If it does not work let me know I dont have a non admin account at my work desk.

Open a Text file and save the code below as DeviceManger.bat

@echo off

:: BatchGotAdmin
:-------------------------------------
REM  --> Check for permissions
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"

REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
    echo Requesting administrative privileges...
    goto UACPrompt
) else ( goto gotAdmin )

:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    set params = %*:"=""
    echo UAC.ShellExecute "cmd.exe", "/c %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs"

    "%temp%\getadmin.vbs"
    del "%temp%\getadmin.vbs"
    exit /B

:gotAdmin
    pushd "%CD%"
    CD /D "%~dp0"
:--------------------------------------
cls
echo.
echo Start as admin:
echo /------------------\
echo # 1. Device Manager#
echo \------------------/
echo.

set /p run=

if %run%==1 (
set run="devmgmt"
)

%run%

Run the .bat and press 1 and hit Enter.

Control Device Installation Restrictions via Registry in Windows Home Editions

As far as I can tell, the Group Policy Objects branch is only a cache of the active GPOs. Windows actually checks this Registry location for computer policy settings:

HKLM\SOFTWARE\Policies

For the Prevent installation of devices that match any of these Device IDs setting, Group Policy uses this key:

HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions

The DenyDeviceIDs DWORD is set to 1 when the policy is Enabled. The DenyDeviceIDsRetroactive DWORD corresponds to the Also apply to matching devices that are already installed checkbox: 1 for checked, 0 for not.

The restricted entries are kept in a subkey of Restrictions that also is named DenyDeviceIDs. One value on that key is one restriction. Each value's name should be the same as its data.

Tip: I found this information using the Element Inspector tool in my own open-source application, Policy Plus.

You'll need to reboot for the changes to take effect.

Note that even if you set all the Registry settings exactly right, it's possible that Home editions might not respect them. Most Group Policy settings work just fine on all editions, but there are a few that don't; the components that make use of them might not be there on Home. If you find that these settings don't work, you'll need to upgrade to Pro.

Best Answer

Related Solutions

Windows – Device manager access for non admins

Control Device Installation Restrictions via Registry in Windows Home Editions

Related Question