How to enable Administrator UAC

To provide a standard user on Windows 11 Pro with administrator capabilities while keeping User Account Control (UAC) active, use one of these approaches depending on the scenario.

1. Prefer: Add the user to the local Administrators group

• Sign in with an existing local administrator account (or the built-in Administrator if it is enabled).
• Open an elevated console (for example, right-click Start > Windows Terminal (Admin)).
• Add the user to Administrators, replacing UserName with the actual account name:

    net localgroup Administrators "UserName" /add
  

• The user will now be an administrator and will see UAC consent prompts when performing admin tasks (Admin Approval Mode).

2. Enable the built-in Administrator account (if needed) This is usually for OEM/manufacturing or recovery scenarios, not day‑to‑day use.

• To enable (for example, during setup or servicing):
  • Use an answer file in unattended setup by configuring Microsoft-Windows-Shell-Setup → AutoLogon to Administrator and setting an AdministratorPassword in the appropriate configuration passes (such as auditSystem and oobeSystem). Example snippet:

        <UserAccounts>
            <AdministratorPassword>
                <Value>SecurePasswd123</Value>
                <PlainText>true</PlainText>
            </AdministratorPassword>
        </UserAccounts>
    

  • Or, on server SKUs, enable via Local Users and Groups MMC:
    1. Open MMC and add the Local Users and Groups snap‑in.
    2. Select Users, right‑click Administrator, choose Properties.
    3. Clear Account is disabled, then select OK.
• To disable the built-in Administrator again (recommended before handing a device to an end user):
  • Run Sysprep with generalize:

        sysprep /generalize
    

    The built‑in Administrator account will be disabled on next boot.
  • Or explicitly disable it:

        net user administrator /active:no
    

3. Configure UAC behavior for the administrator Once the user has administrator rights, UAC controls how and when prompts appear.

• Open Control Panel > System and Security > Change User Account Control settings.
• Choose the desired level with the slider:
  • Always notify – prompts for both app installs/changes and Windows settings changes; desktop is dimmed.
  • Default (Notify me only when apps try to make changes) – prompts for app installs/changes, not for changes made directly in Windows settings; desktop is dimmed.
  • Notify me only when apps try to make changes (do not dim my desktop) – similar to default but without secure desktop dimming.
  • Never notify – effectively disables UAC prompts; not recommended due to security risk.

4. How UAC behaves for administrators

• When a user is in the local Administrators group, Windows runs them in Admin Approval Mode.
• Admin tasks trigger a consent prompt, where the user must approve elevation before the action runs with full administrator privileges.
• This protects the system from silent elevation by malware while still allowing the administrator to perform required tasks.

For business devices, best practice is to:

• Keep UAC enabled (at least the default level).
• Use a standard user account for everyday work and an administrator account (or elevation via UAC) only when necessary.

References:

• Enable and disable the built-in administrator account
• User Account Control overview
• User Account Control settings
• How User Account Control works