Disable User Account Control Using Group Policy

Disable User Account Control Using Group Policy User Account Control feature basically aims to improve the security of Microsoft Windows by limiting application software to standard user privileges until an administrator authorizes an increase or elevation. In this way, only applications trusted by the user may receive administrative privileges, and malware should be kept from compromising the operating system. In other words, a user account may have administrator privileges assigned to it, but applications that the user runs do not inherit those privileges unless they are approved beforehand or the user explicitly authorizes it. If you have administrator privileges on your PC, you can also fine-tune UAC’s notification settings in Control Panel.

When changes are going to be made to your computer that require administrator-level permission, UAC notifies you. If you are an administrator, you can click Yes to continue. If you are not an administrator, someone with an administrator account on the computer will have to enter their password for you to continue. If you give permission, you are temporarily given the rights of an administrator to complete the task and then your permissions are returned back to that of a standard user. This makes it so that even if you’re using an administrator account, changes cannot be made to your computer without you knowing about it, which can help prevent malicious software (malware) and spyware from being installed on or making changes to your computer.

Disable User Account Control Using Group Policy

We will create a group policy and define the settings to disable the UAC.

First open the Server Manager Console and click on Tools. Now click Group Policy Management from the drop down. Right click on the domain and click on Create a GPO in this domain and link it here. Provide a suitable name to the GPO and right click the policy and click on Edit.

In the GPMC editor click on Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. On the right pane there are lot of settings that you see, so you need to modify the following policies.

1) User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode = Right click policy setting, click Properties. Check the box Define this policy setting and choose Elevate without prompting.

2) User Account Control: Detect application installations and prompt for elevation = Right click policy setting, click Properties. Check the box Define this policy setting and choose Disabled.

3) User Account Control: Run all administrators in Admin Approval Mode = Right click policy setting, click Properties. Check the box Define this policy setting and choose Disabled.

Run gpupdate /force on Windows client machine. The logged on users might see a notification that a restart is required to turn off user account control. After the restart of the client machine you will see that UAC is set to Never notify on the client machine.