Change User Access Control Behavior: Complete Guide

This guide provides a clear overview of change user access control behavior, including UAC Behaviors Available for Standard User Accounts, how to Change UAC Behavior for Standard Users in Local Group Policy Editor. Use it to understand the topic, compare the available options, and make a more informed decision.

UAC Behaviors Available for Standard User Accounts

Unlike when changing the UAC behavior for the admin account, the behavior for the standard user account is a bit more restrictive. According to the Microsoft Learn website, here are the behaviors you can choose from and what they mean:

• Automatically deny elevation requests : This option returns an access denied error message to standard users when they try to perform an operation that requires admin rights. Most organizations that run the desktop as a standard user configure this policy to reduce calls to the helpdesk.
• Prompt for credentials on the secure desktop : When an operation requires admin rights, the user will see a security screen prompting for a username and password. If the user enters valid credentials, the operation will continue with the privilege applied.
• Prompt for credentials : An operation that requires admin rights will prompt the user to enter the admin username and password. If the user enters valid credentials, the operation will continue with the privilege applied.

The default UAC behavior for standard user accounts is Prompt for credentials , but Microsoft recommends changing it to Automatically deny elevation requests . That way, only users with an admin account can decide how UAC works and make choices that will keep computers safe.

How to Change UAC Behavior for Standard Users in Local Group Policy Editor

The easiest way to change how UAC behaves for standard users is to adjust the policy User Account Control: Behavior of the elevation prompt for standard users . To do that, open Local Group Policy Editor and follow the steps below.

Note : Local Group Policy Editor is not available by default on Windows Home. Therefore, let's see how to access the Local Group Policy Editor on Windows Home before continuing.

1. Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options .

2. Right-click the User Account Control: Behavior of the elevation prompt for standard users policy and select Properties in the menu.

3. Expand the drop-down list and choose a different UAC behavior.

4. Click OK.

Remember that only admin can change the behavior of UAC. For example, if a standard user tries to change it using the Local Group Policy Editor, they may receive an Access denied error message.

How to Change UAC Behavior for Standard Users in Registry Editor

If you are looking for another way to change UAC behavior for standard users or Local Group Policy is not working on your computer, you can make the changes in the Windows Registry instead.

However, before you do that, you should create a system restore point to protect your computer in case something goes wrong. Once you do that, open the Registry Editor and follow the steps below:

1. Copy HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem and paste it into the address bar at the top of the Registry Editor.

2. Press Enter on your keyboard to go to the System key.

3. Right click on the ConsentPromptBehaviorUser value in the right panel and select Modify.

4. In the Value data text box, enter 0 for Automatically deny elevation requests , 1 for Prompt for credentials on the secure desktop or 3 for Prompt for credentials .

5. Click OK.

6. Now, restart your computer for the changes to take effect.

Conclusion

Understanding Change User Access Control Behavior makes it easier to compare options, avoid common mistakes, and apply the information in this guide more effectively. Review the relevant requirements before making changes or choosing a solution.