uac user account control. What does account control disabled mean?


Account Control (User Account Control), is probably the most underrated and perhaps even the most hated feature that debuted in Vista and has been part of all subsequent versions of Windows. For the most part, the stream of hatred that users throw out on User Account Control, I consider undeserved, since the function has real benefits. I completely agree that User Account Control (UAC) can be quite annoying at times, but it was introduced into Windows for a purpose. No, not to interfere with users, but to facilitate smooth transition from a standard (limited) account to account administrator.

In this article, I'll explain what UAC is, how it works, why it's necessary, and how to set it up. I have no intention of telling you why you should use UAC, but rather informing you of what you're missing out on by disabling it.

A little background and account information

As you should know, Windows works with so-called accounts. They come in two types: administrator and standard (limited).

The administrator account gives the user full access to all functions of the operating system, i.e. the user can do whatever he wants. A standard account user has reduced rights and is therefore only allowed to do certain things. This, as a rule, is all that affects only current user. For example: changing the wallpaper on the desktop, mouse settings, changing the sound scheme, etc. In general, everything that concerns specific user and does not apply to the entire system, available in a standard account. Anything that can affect the system as a whole requires administrator access.

One of the tasks assigned to these accounts is to protect against malicious code. The general idea here is that regular work the user ran under a restricted account and switched to the administrator account only when the action required it. Paradoxical as it may seem, but malware receive the same level of rights with which the user logged in.

In Windows 2000 and Windows XP, performing actions as an administrator is not implemented flexible enough, and therefore working under a limited account was not very convenient. One way to perform an administrative action on these versions of the system is to log out of the restricted account (or fast switching, if Windows XP was used) -> log in to the administrator account -> perform an action -> exit the administrator account (or quickly switch if Windows XP was used) -> return to a limited account.

Another option is to use context menu and the “Run as another user” option, which opens a window in which you must specify the appropriate administrator account and password to run the file as an administrator. This is enough quick way switching from one account to another, but it does not apply to any situation that requires administrative privileges. Another problem with this method is that the administrator account must have a password, otherwise execution will fail.

That's why in Windows Vista The User Account Control function was introduced, and in Windows 7 it was brought almost to perfection.

What is UAC

UAC is a feature in Windows Vista, 7, 8, 8.1 and 10 that aims to make the transition from a restricted environment to an administrator environment as smooth and hassle-free as possible, eliminating the need to manually run files as an administrator or switch between accounts. In addition, UAC is an additional layer of protection that requires little effort on the part of the user, but can prevent serious damage.

How UAC works

When a user logs into their account Windows entry creates a so-called user access token, which contains certain information about a given account and mainly various security identifiers that the operating system uses to control the access capabilities of this account. In other words, this token is a kind of personal document (like a passport, for example). This applies to everyone Windows versions based on the NT kernel: NT, 2000, XP, Vista, 7, 8 and 10.

When a user logs into a standard (limited) account, a standard user token with limited rights is generated. When a user logs into an administrator account, a so-called. administrator token with full access. Logical.

However, in Windows Vista, 7, 8 and 10, if UAC is enabled and the user is logged into an administrator account, Windows creates two tokens. The Administrator one remains in the background, and the Standard one is used to launch Explorer.exe. That is, Explorer.exe runs with limited rights. In this case, all processes launched after this become subprocesses of Explorer.exe with inherited limited privileges of the main process. If a process requires administrative rights, it requests an administrator token, and Windows in turn asks the user for permission to provide the process with this token in the form of a special dialog box.

This dialog box contains the so-called secure desktop, which can only be accessed by the operating system. It looks like a darkened snapshot of a real desktop and only contains a confirmation window for administrator rights and possibly language bar(if more than one language is activated).

If the user does not agree and clicks “No,” Windows will deny the process an administrator token. And if he agrees and selects “Yes,” the operating system will grant the process the privileges it needs, namely, an administrator token.

If the process is already running with reduced rights, it will be restarted with elevated (administrator) rights. A process cannot be demoted or promoted directly. Once a process has been launched with one token, it will not be able to obtain other rights until it is launched again with new rights. An example is the Task Manager, which always runs with limited rights. If you click the "Show processes of all users" button, Task Manager will be closed and launched again, but with administrator rights.

When using a standard account, UAC asks you to specify a specific administrator account and enter a password:

How UAC protects the user

UAC by itself does not provide much security. It just makes it easier to transition from a restricted environment to an administrative one. So a better way of asking the question is therefore how a restricted account hinders the user. Under a restricted user profile, processes cannot access certain system areas:

  • main disk partition;
  • custom folders other users in the \Users\ folder;
  • Program Files folder;
  • Windows folder and all its subfolders;
  • sections of other accounts in the system registry
  • HKEY_LOCAL_MACHINE section in the system registry.

Any process (or malicious code) without administrator rights cannot penetrate deeply into the system, without access to the necessary folders and registry keys, and therefore cannot cause serious damage to the system.

Can UAC interfere with older programs that are not officially compatible with Vista/7/8/10

Should not. When UAC is enabled, virtualization is also enabled. Some old and/or simply poorly written programs do not use the correct folders to store their files (settings, logs, etc.). The correct folders are the folders in the AppData directory that each account has and where each program can create a folder to store whatever it wants.

Some programs try to save their files to Program Files and/or Windows. If the program is run with administrator rights, this will not be a problem. However, if the program is running with limited permissions, it will not be able to make changes to files/folders in Program Files and/or Windows. The operating system simply won't allow it.

In order to prevent problems with such programs, Windows offers virtualization of folders and registry keys that programs with limited rights cannot access in principle. When similar program tries to create a file in a protected folder, the operating system redirects it to special folder VirtualStore, which is located in X:\Users\<имя-вашего-профиля>\AppData\Local\(where X: is system partition, usually C:). Those. Through the eyes of the program itself, everything is fine. She faces no obstacles and feels like she creates files/folders exactly where she wants them. VirtualStore typically contains Program Files and Windows subfolders. Here is a screenshot of Program Files in my VirtualStore folder:

And here is what is in the SopCast folder, for example:

Those. if UAC was stopped, or the program was always run as administrator, these files/folders would be created in C:\Program Files\SopCast. In Windows XP, these files and folders would be created without problems, because all programs in it have administrator rights by default.

This, of course, should not be considered by developers as a permanent solution. The responsibility of each author is to create software that is fully compatible with current operating systems.

UAC Dialog Boxes

You may have noticed that there are only three different dialog boxes UAC. Here we will look at those in Windows 7, 8.x and 10. In Vista, the dialogs are somewhat different, but we will not dwell on them.

The first type of window has a dark blue stripe at the top and a shield icon at the left top corner, which is divided into 2 blue and 2 yellow sections. This window appears when confirmation is required for a process with a digital signature that belongs to the operating system - the so-called. Windows binaries. We'll talk about them below.

The second type of window is also with a dark blue ribbon, but the shield icon is completely blue and with question mark. This window appears when confirmation is required for a digitally signed process, but the process/file is not owned by the operating system.

The third window is decorated with an orange stripe, the shield is also orange, but with exclamation mark. This dialog appears when confirmation is required for a process without a digital signature.

UAC Settings

User Account Control settings (operating modes) are located in Control Panel -> System and Security -> Change User Account Control settings. There are only 4 of them:

Always notify is the most high level. This mode is equivalent to the way UAC works in Windows Vista. In this mode, the system always requires confirmation of administrator rights, regardless of the process and what it requires.

The second level is the default in Windows 7, 8.x and 10. In this Windows mode does not bring up a UAC window when it comes to so-called Windows binaries. Those. If a file/process that requires administrator rights meets the following 3 conditions, the operating system will grant them to it automatically, without confirmation from the user:

  • the file has a built-in or in the form separate file manifesto, which indicates automatic elevation of rights;
  • the file is in Windows folder(or in any of its subfolders);
  • the file is signed with a valid Windows digital signature.

The third mode is the same as the second (previous), but with the difference that it does not use a secure desktop. That is, the screen does not darken, and the UAC dialog box appears like any other. Microsoft does not recommend using this option, and I will explain why later.

Do not notify me is the fourth and final level. In fact this means complete disabling UAC.

Two remarks are in order here:

  • digital Windows signature refers specifically to the operating system. I say this because there are also files that have been digitally signed by Microsoft. These are two separate signatures, with UAC only recognizing the Windows digital signature as it acts as proof that the file is not only from Microsoft, but is part of the operating system.
  • Not all Windows files have a manifest for automatic elevation of rights. There are files that deliberately lack this. For example, regedit.exe and cmd.exe. It is clear that the second one is deprived of automatic promotion, because it is very often used to launch other processes, and as already mentioned - each new process inherits the rights of the process that launched it. This means that anyone could use the Command Prompt to run any processes seamlessly with administrator rights. Fortunately, Microsoft is not stupid.

Why is it important to use a secure desktop?

A secure desktop prevents any possible interference and influence from other processes. As mentioned above, only the operating system has access to it and only accepts basic commands from the user's side, that is, pressing the “Yes” or “No” button.

If you are not using a secure desktop, an attacker could spoof a UAC window to trick you into launching your malicious file with administrator rights.

When are administrator rights needed? When does the UAC window appear?

In general, there are three cases in which UAC addresses the user:

  • when changing system (not user) settings, although in fact this only applies to the maximum UAC level;
  • when installing or uninstalling a program/driver;
  • when an application/process requires administrator privileges to make changes to system files/folders or system registry keys.

Why it's important not to disable UAC

User Account Control provides a high level of protection, and requires virtually nothing in return. That is, the UAC efficiency is very high. I don't understand why he annoys people so much. In everyday work, the average user sees the UAC window 1-2 times a day. Maybe even 0. Is it that much?

The average user rarely changes system settings, and when they do, UAC does not bother with its questions if it works with the default settings.

The average user does not install drivers and programs every day. All drivers and most necessary programs installed once - after Windows installations. That is, this is the main percentage of UAC requests. After this, UAC intervenes only when updating, but new versions of programs are not released every day, not to mention drivers. Moreover, many do not update either programs or drivers at all, which further reduces UAC issues.

Very few programs need administrator rights to do their job. These are mainly defragmenters, cleaning and optimization tools, some diagnostic programs (AIDA64, HWMonitor, SpeedFan, etc.) and system settings ( Process Explorer and Autoruns, for example, but only if you need to do something specific - say, disable a driver/service or starting with Windows program). And all these are programs that either need not be used at all, or in rare cases. All frequently used applications work absolutely fine with UAC and do not ask any questions:

  • multimedia players(audio and/or video);
  • video/audio converters;
  • programs for image/video/audio processing;
  • programs for capturing screenshots of your desktop or video recordings on it;
  • image viewing programs;
  • web browsers;
  • file downloaders (download managers and clients of P2P networks);
  • FTP clients;
  • instant messengers or programs for voice/video communication;
  • disc burning programs;
  • archivers;
  • text editors;
  • PDF readers;
  • virtual machines;
  • and etc.

Even installation Windows updates does not use the UAC window.

There are people who are willing to sacrifice 1-2 or more minutes a day to "optimize" the system with some crookedly written programs that do nothing useful, but are not willing to spend a few seconds a day to respond to UAC requests.

Various statements like “I am an experienced user and I know how to protect myself” are not enough, because no one is immune and the outcome of certain situations does not always depend on the user. Moreover, people tend to make mistakes; it happens to everyone.

Let me give you one example: let's say you are using a program that has vulnerabilities, and one day you find yourself on a site that exploits those vulnerabilities. If User Account Control is enabled and the program runs with limited rights, an attacker will not be able to cause much trouble. Otherwise, the damage to the system can be colossal.

And this is just one of many examples.

Running applications alongside Windows with administrator rights

I admit that there may be users who turn off UAC simply to be able to run programs along with Windows and with administrator rights. In the usual way this is not possible because UAC cannot send a request to the user until the desktop is loaded. However, there is a way through which you can leave UAC enabled. Here he is:

  • open Task Scheduler;
  • click Create a task;
  • in field Name enter something of your choice, and at the bottom of the window turn on the option Run with highest rights;
  • go to the tab Triggers and press Create;
  • Select from the drop-down menu at the top When you log in; if you want to create a task for a specific user, select the option User and then click Change user; enter your username and confirm by pressing the button OK;
  • go to the tab Actions and press Create;
  • click Review, indicate the appropriate application and confirm your choice;
  • go to the tab Conditions and disable the option Run only on mains power;
  • on the tab Options disable the Stop task that takes longer to complete option;
  • confirm by pressing OK.

Ready. The task has been added so that the application will now load automatically with administrator rights. There is, however, one small catch here: all such tasks are performed with a priority lower than normal - below normal (below normal). If you're okay with that, then it's okay. If not, then you'll have to work a little harder:

  • run Task Scheduler if you have already closed it;
  • select Job Scheduler Library;
  • mark your task, click Export and save it in .xml format;
  • open the .xml file in text editor;
  • find the section 7 , which should be at the end of the file and change the seven (7) between the opening and closing tags to a five (5);
  • save the file;
  • In the Task Scheduler, highlight your task again, click Delete and confirm the deletion;
  • now click Import task, select the file you just saved and click the button OK.

That's all. Whether you use UAC or not is up to you, but it's important to know what you're losing when you disable it, as well as being aware of the risks. Thank you for your attention!

Have a great day!

Many operating room users Windows systems 7 are interested in how to disable User Account Control (UAC). UAC is useful service, developed by Microsoft to ensure system security, control over installation, changing the state of programs, and preventing unauthorized management of files in general.

Despite all the benefits of this service, some experienced users, as well as owners of anti virus programs, want to disable User Account Control. The reasons for deactivation may vary. From desire full control and control the system until elimination annoying windows with warnings.

The system provides several different methods for disabling UAC.
We'll look at two simple methods. The first one is suitable for the majority of G7 owners. The second is for more experienced users.
So let's get started.

Method No. 1

The first thing you need to do is click on the familiar “start” button. After that, find and select the “control panel” tab from the list.

An active panel window with computer settings settings should appear in front of you.
Next, select and click on the “User Accounts and Family Safety” section

After transition not next active screen, select “user accounts”.

When the selection is made, an interface with an icon of the current (active) authorized user will appear. At the end of the list various settings You should find and select “Change User Account Control settings.”

The scale provides options for choosing from 4 ready-made modes:

— top position– this is maximum protection and constant notifications;

— second position from top. Indicates standard mode;

— in the third position notifications occur when changes are attempted;

— fourth(lowest position) completely disables protection.

To completely disable User Account Control, we need to move the slider to the lowest position and click on the “ok” button.

The entire procedure for disabling security control is almost completed. All that remains is to reboot the system for the new settings to take effect.
As you can see, everything is quite simple and fast.

Method No. 2

The second method of disabling, just like the first, involves moving the slider to the lowest position. The only difference is that to call the notification settings dialog box, you need to register a specific command on the Windows command line.

To open command line you will need to click on the “start” button, go to right menu and click on the “Run…” tab

A small window will appear that looks like this: Our goal is to call the command line. To do this, enter “cmd” in the text input field.

After the command line appears, write or paste the following value:

UserAccountControlSettings.exe

press the “enter” key.

A dialog box already familiar to us appears, with a school for manual settings. We select the option we need, save the result, and restart the computer.

At this point all work is completed.

Note! Disabling the security mode of your operating system (UAC) is recommended only for experienced users. If you don't realize possible consequences shutdown or have a lack of knowledge in the area computer security, we strongly recommend that you do not change the system default settings.

Hello! Today I decided to write another piece of advice in which I’ll tell you how How to disable User Account Control (UAC) in Windows 7. What's the first thing you do afterwards? Yes, I also install different programs :). And you probably also noticed a warning that looks like this:

What is it and what does it give? Is it User Account Control, or UAC. It serves to prevent changes to be made to the computer. third party programs, or more correctly, dangerous programs. By default, UAC is enabled, and every time you try to install a program, a window with a question will appear. Do you allow this program to make changes to your computer?

If you click yes, the installation of the program will begin, but if not, then nothing will happen and the program will not be installed. Personally, I think such a check is useless, and it only distracts all the time with its warnings. That's why I always disable UAC.

How to disable UAC?

To disable this check, you need to log in to the system as an administrator. We go to “Start”, "Control Panel".

We look for the item and select it.

We choose.

A window will open in which you need to drag the pointer to the very bottom, to “Never notify”. After that, click “Ok”.

A message appears asking if you have permission to make changes to your computer. Click “Yes”. After this, the support center will inform you that to disable User Account Control, you need to restart your computer.

UAC element operating systems from Microsoft, which appeared in the failed Vista. It asks the user for confirmation to perform actions on the computer that require administrative privileges. This is done to prevent unauthorized changes to system parameters. If you are sure that you will not harm the computer through your own actions, and it is protected antivirus program, below shows how to disable UAC in Windows 10.

Such windows pop up due to time changes, launching installation files, changes to the registry, start settings and taskbar, as well as when configuring Windows 10 through “Settings” and “Control Panel”.


In addition to protecting the computer from a significant number of malware and viruses, UAC warns the user when he tries to change important settings OS. Thanks to the pop-up warning window, the user begins to take greater responsibility for making changes to the top ten.

A
It's no secret that User Account Control is enabled by default. The protection level is at 3 out of four possible positions.

  • “Always notify the user about attempts to install/uninstall an application or make adjustments to system registry by any means." Option provides maximum safety computer and will not allow any programs or scripts to perform any action requiring administrative privileges without your knowledge. Non-administrators will have to continually enter their password to confirm actions.
  • “Alert when applications try to make changes to your computer without obscuring the desktop.” The default setting allows you to control only the operation of applications, but not user actions.
  • The same as the previous option, but with shading of the desktop.
  • “Never notify” - UAC is disabled and does not display any warnings.

Now that we’ve figured out the mechanism of operation and purpose of the User Account Control tool, let’s look at how to disable UAC in Windows 10.

Disabling via GUI

The easiest for beginners and, therefore, the most popular way to deactivate the tool is the control panel applet called “Accounts”.

  1. Go to the “Control Panel” using the WinX menu.
  2. We go to the point responsible for setting up accounts (it is located one of the last).
  3. Click on the link “Change User Account Control Settings”.

The action will require the user to have administrator privileges.


An easier way to open this window is to run the command in search bar or the “Run” window (to call it, use the Win+R button combination).


A window that opens with a vertical slider with four positions allows you to manually change UAC settings. Moving the slider is accompanied by the appearance of an explanation of its current state, which were described above.

To disable UAC, move the slider to the bottom position, click “OK” and confirm the action that requires changes to be made Windows registry 10.


Having decided to get rid of annoying messages that regularly pop up, you should be extremely careful, because any application or script will have the same rights as the user. UAC will not be able to report activity malicious applications, which are allowed to change almost any Windows settings and modify a significant part system files, including registry entries.

Disable UAC through the system registry

The registry, whose entries are accessed through a special editor, stores most of the settings and information related to your computer and Windows 10. UAC settings that you can change through the Control Panel are also stored in the registry. Therefore, they can be changed by editing the corresponding keys.

  1. Execute "regedit".
  2. One by one, expand the sections HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
  3. Set the PromptOnSecureDesktop value to “0” after double-clicking on the name/icon of the key.
  4. Similarly, change ConsentPromptBehaviorAdmin to “0”.


Changes take effect immediately after clicking the “OK” button, without requiring the user to restart Windows shell 10 or the OS itself.

The PromptOnSecureDesktop key is responsible for dimming the desktop (1 - dim, 0 - not, other values ​​are automatically equal to one) when UAC is enabled.

ConsentPromptBehaviorAdmin and PromptOnSecureDesktop values ​​can be as follows:

  • 1 and 2 correspond to the top position of the slider - always notify;
  • 1 and 5 - second position - default value;
  • 0 and 5 - notify without dimming the screen.

User Account Control (abbreviated as UAC) is a security feature that helps prevent unauthorized changes to your PC, which may be caused by software, viruses, or other users. UAC ensures that changes are made with administrator permission. In this case, the program execution stops and a confirmation window pops up. Over time, this becomes somewhat annoying, so the lesson is dedicated to how to disable User Account Control in Windows 7.

Note: Disabling UAC will reduce system security. Make sure that running the application will not harm your PC.

It is possible to remove the annoying component window using 4 methods:

  1. Through the Account Control Levels window
  2. By using group policy
  3. Using the registry
  4. Using the command line

In addition to the described algorithm of actions, you can download ready-made options that disable account control in a couple of mouse clicks. We’re ready to get rid of constantly popping up messages, then let’s get started.

Disabling through the User Account Settings window

The shortcut for launching User Account Control options is located in system folder System32 and is called UserAccountControlSettings.exe. With its help you can disable uac in windows 7 by moving the slider with the mouse. Follow these steps:

3. On the left side of the open window, move the slider to 4 points (shown in the image) and click OK. This will turn off User Account Control and annoying Windows 7 warnings.

4. Don't expect results right away. The changes will be applied after the next startup or reboot of the PC.

Disabling UAC via Group Policy

The the method will work only to Windows editions 7:

  1. Professional
  2. Maximum
  3. Corporate

Other editions are deprived changes to User Account Control options through the Local Group Policy component, due to its reduced capabilities. If you are their owner, skip these instructions, otherwise read on.

1. Launch the Local Group Policy interface. Press Win (button with Logo) + R, enter in the form that opens secpol.msc and click enter.

2. If a UAC prompt appears, click “yes”. In the window, click on the arrow next to the “ local policies", then select the "Security Settings" subsection. A list of policies will be displayed on the right. Find the “Account Control” item, where it says “all admins work in admin approval mode” separated by a colon (see picture). Double-click on it with the mouse.

3. In the option properties, select “disabled”. Click "apply" then OK. Close all windows and restart your computer.

Removing warnings using the registry

To disable User Account Control in Windows 7, follow the steps sequentially and do not change other settings.

1. . Click on , type regedit.exe into the search and press enter.

2. Get to the System subsection (full path in the screenshot). In the right pane, find the option EnableLUA, double click on it.

3. Set the value to 0, which disables UAC. Accordingly, 1, on the contrary, turns on. Click OK. Restart the system.

There is also ready-made option. Download the archive and extract it. The archive contains 4 REG files, which are responsible for the levels of user account control.

  1. Uroven-1.reg
  2. Uroven-2.reg
  3. Uroven-3.reg
  4. Uroven-4.reg – UAC disable file

4 each REG file Right-click and select “merge” from the menu. Confirm the action by clicking “yes” twice. Then restart Windows 7.

Disable User Account Control via cmd

First, find out. When you decide on the opening method, . I suggest copying the following code into it and pressing enter to disable UAC in Windows 7:

%windir%\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

You can immediately or through “start”. Then check the result.

The article suggested disable User Account Control in Windows 7 different methods. Complete shutdown will undermine the security of the PC as a whole. If you decide to sacrifice security, then install and maintain current antivirus database data. A number of programs require UAC to be running, for example in Windows 8 you need to enable User Account Control. For maximum protection, do not disable this option.


2024 gtavrl.ru.