Changing the UAC Setting Prompt for Built-In Admin account?

win10freak · 05 Apr 2019

Just wondering if I need to set the following UAC Prompt for the Built-In Administrator account even when its disabled by default? I created my own Admin account during Windows 10 installation, but by default, the Built-In Admin account is disabled. So do I need to set the following from the below tutorial to ENABLE even if the Built-In Admin account is disabled?

Enable or Disable UAC prompt for Built-in Administrator in Windows

Brink · 05 Apr 2019

Hello win10freak,

The group policy in that tutorial will only affect the built-in "Administrator" account, and no other account.

By default, the built-in Administrator doesn't get prompted by UAC for elevation since the account runs with elevated rights by default.

You really would only want to use that group policy if you wanted the built-in Administrator to be prompted by UAC for elevation instead.

It doesn't matter if the built-in Administrator is current disabled or not. The group policy would affect it whenever you enable/disable the account.

win10freak · 05 Apr 2019

So, I looked into that specific UAC Group Policy setting and currently is set to Not Defined.
Even if I will not enable the built-in Admin account, should I still set a Group Policy to Enable?

Brink · 05 Apr 2019

"Not Defined" just means the group policy is "Not configured", and currently at its default of not prompting the built-in Administrator with UAC for elevation.

It really depends on what you want or not for the UAC prompt for the built-in Administrator.

I'd say, there's no need to set this unless you want to have the built-in Administrator prompted by UAC.

win10freak · 05 Apr 2019

If I don't have the need to use the built-in Admin account and just leave it disabled, should I leave it as Not Defined?

Brink · 05 Apr 2019

I would.

You don't want to configure group policy settings unless you have a need to do so.

win10freak · 05 Apr 2019

Thanks! Appreciate the support and detailed explanation.

However, slightly off topic here, but what about setup programs that a user can just change to their User Profile instead of a System folder like the Program Files folder? If a Standard User installs an app like Utorrent for example without changing the installation destination (C:\Program Files), then of course, the UAC will prompt for the Admin credentials. But when the user changes the installation path to their User Folder or wherever a directory does not need Admin rights to install, then its bad news...

So I guess there is a slight flaw in this UAC prompt thing when it comes to applications like these.

Best UAC setting if one likes to be more secure, then UAC setting for Standard Users should be: Automatically deny elevation requests.

Change UAC prompt Behavior for Standard Users in Windows

Utorrent is one example, see the image.

Brink · 05 Apr 2019

A user will be able to specify any path they have access rights (aka: permissions) to.

Disabling UAC for standard users wouldn't help for that.

win10freak · 06 Apr 2019

Just realized, that this more restrictive setting does not allow me to update Adobe updates/patches and may not even update Windows unless I sign out from my Standard User Account and logon to my Admin account which is not convenient. So, I had it changed back to just Prompt for Consent on the Secure Desktop.