UAC popup appears for some self-developed applications after Windows Update

Question

UAC popup appears for some self-developed applications after Windows Update

ChiaYuan Lin 10

This issue may be related to Visual Studio settings, but since it started occurring after a Windows Update, I would like to ask here.

I am not sure which update caused the issue, but after the updates installed on 2026/05/13, some of my self-developed applications started showing a UAC popup when launched.

The installed updates are:

.NET Framework Security Patch (KB5087051)

Security Patch (KB5089549) (OS Build 26200.8457)

The affected applications are digitally signed, and the signing certificates are still valid.

In addition, some applications built in the same way do not show this issue. When comparing the affected and unaffected applications, there are almost no differences in their settings, including the manifest configuration. The only noticeable difference seems to be the executable file name.

Also, the applications that trigger the UAC popup have a shield icon overlay on the executable icon.

Questions

I would like to ask the following:

Were there any changes to the UAC detection logic in KB5089549 or KB5087051?
Under what conditions does Windows add the shield icon overlay to an executable?
Does Windows use EXE file names (for example, containing setup or install) as part of the UAC or installer detection logic?
Even without requireAdministrator in the manifest, are there conditions under which Windows automatically treats an application as requiring administrator privileges?

If anyone has experienced a similar issue or has related information, I would appreciate your advice.

Michael Sandells 41 Reputation points

2026-05-18T10:13:59.4933333+00:00

We're seeing this as well...

For us, this is happening on exes that have no requestedPrivileges section in their manifest, and ensuring that they do have one (with requestedExecutionLevel of asInvoker) makes the unwanted UAC behaviour go away.

We've opened a support call with Microsoft as to whether there are other things we can do about this.

Update: From further experimentation of our own, I think I know what's going on here. If a file has no requestedPrivileges section in its manifest, Windows is now looking at the filename and the versioninfo metadata (and maybe elsewhere) for particular keywords. If it finds "Install", "Update" (and maybe other values), it assumes that elevation is needed and triggers a UAC prompt. This behaviour seems to be introduced in the May updates.

The fix is to ensure that you always have a manifest that is explicit about whether it requires admin rights or not. Or, failing that, avoid words like "Install" or "Update" in the versioninfo or filename.

We've not found any documentation covering this, but empirically this seems to be what's going on. We can make an exe have or not have the problem based on how it is named and what is in its versioninfo.

To be clear, Windows deciding for itself that certain programs should be run elevated does not seem the best idea from a security perspective. And unless there is a way to configure this, it renders such programs (which do not actually need elevating) unusable by an unprivileged user, who cannot get past the UAC prompt.

All the fixes assume that the affected exes are your own that you can recompile differently or modify, but that won't necessarily be the case, so I'd guess this is going to cause some wider issues.

Update2 [26.05.2026]: Microsoft have now got back to us, and while there is no more detail on what changed, they have referred us to a group policy that should disable the whole thing:

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation

i.e. what's changed is how Windows infers whether something is an installer or not, and that whole system can be disabled if needed. Not tried this yet, but that looks like it should work in cases where fixing the exe isn't an option.
Nick Garbe 5 Reputation points

2026-05-20T09:16:47.45+00:00

We have the same issue with a program developed by IBM.
IBM SPSS Statistics, we are getting an UAC prompt on our end user devices since this update: https://support.microsoft.com/help/5089549
Also, the icon changed since the update and now have an UAC logo attached.
Giving our end users local admin rights is not an option...
Dale 5 Reputation points

2026-05-21T12:22:35.0466667+00:00
We have also had the same issue with our IBM SPSS version 28. Although not related to OPs update IBM have put it as a known issue: https://www.ibm.com/mysupport/s/defect/aCIgJ000000E0jJWAS/dt471263?language=en_US

I had a ticket open with MS support and they suggested the below. Might work for other applications too:

Please try the steps below:

Check Application Compatibility Settings

Navigate to: C:\Program Files\IBM\SPSS\Statistics\28\

Right-click stats.exe → Properties

Go to the Compatibility tab

Ensure:

“Run this program as an administrator” is unchecked

No compatibility mode is enabled Click Apply → OK

Apply RunAsInvoker Fix (Recommended if issue persists)

This prevents Windows from forcing elevation:

Use Microsoft Application Compatibility Toolkit (ACT)

Create a compatibility fix for stats.exe

Apply the RunAsInvoker setting

This is a standard enterprise workaround for UAC-related issues.

Repair or Reinstall SPSS

Reinstall SPSS using the latest available installer from IBM

Ensure installation is performed with administrator privileges

This may correct any manifest or permission-related issues

Temporary Workaround

If the issue is blocking operations:

You may consider uninstalling the update temporarily: Settings → Windows Update → Update History → Uninstall Updates or via command: wusa /uninstall /kb:5089549

This should only be done after internal validation.

Since this issue appeared directly after a Windows update, we strongly recommend raising a support ticket with Microsoft Windows Support. [https://engagecenter.microsoft.com/](https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fengagecenter.microsoft.com%2F&data=05%7C02%7Cdale.bryce%40kynetec.com%7C8c25fa16a9fd4c83281d08deb70986c3%7C28c25355d98b4a658b33c5e4bb122676%7C0%7C0%7C639149448712077482%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=tgq718pTcU0ab1z2VJuWKjxv4s6Wtc9XGX8Zk%2Bqm8Yc%3D&reserved=0"Original URL: https://engagecenter.microsoft.com/. Click or tap if you trust this link.")Please try the steps below:

1 answer

Your answer

Nick Garbe 5 Reputation points

2026-05-20T09:16:47.45+00:00

We have the same issue with a program developed by IBM.
IBM SPSS Statistics, we are getting an UAC prompt on our end user devices since this update: https://support.microsoft.com/help/5089549
Also, the icon changed since the update and now have an UAC logo attached.
Giving our end users local admin rights is not an option...

Answer 1

The described behavior matches recent intentional changes to elevation and UAC behavior introduced by Windows updates, similar to the change where accessing Storage settings began requiring elevation after KB5074105.

From the available information:

Changes to UAC detection logic in recent updates

KB5074105 (OS build 26200.7705) introduced a change where opening Settings → System → Storage started triggering a UAC prompt. A moderator explanation states this was an intentional configuration addition for safety concerns, not a bug. This shows that recent Windows builds are tightening elevation requirements for certain operations and entry points.

Given that KB5089549 is a security update for OS build 26200.8457, it is consistent with this pattern that UAC/elevation behavior for some executables or scenarios has been hardened. The context does not list the exact internal UAC logic changes for KB5089549 or KB5087051, but it does confirm that similar updates have intentionally changed elevation behavior.

Conditions under which Windows adds the shield overlay

The shield overlay appears when Windows determines that launching the executable will require elevation. The Storage settings example shows that even a system settings page can be reclassified to require elevation after an update, which then causes a UAC prompt.

In practice, this overlay appears when:

The system now treats the target as performing privileged operations that must run elevated, or
The configuration for that entry point (shortcut, settings page, or associated component) has been updated to require elevation for safety.

The context does not provide a full list of all conditions, but it clearly shows that updates can change configuration so that previously non-elevated entry points now require elevation and thus show the shield.

Use of EXE file names in detection logic

The provided context does not explicitly document any logic that uses EXE file names such as setup or install as part of UAC or installer detection, so no statement can be made from this material about name-based detection.

Automatic elevation without requireAdministrator in the manifest

The Storage settings case demonstrates that Windows can require elevation for an operation even though the user did not explicitly request requireAdministrator in an application manifest. The change was described as an intentional configuration addition for safety.

This shows that:

Windows can reclassify certain operations or components as requiring elevation via configuration or updates.
When this happens, UAC prompts can appear even if the application itself has not changed its manifest.

Applied to the described scenario, it is consistent that after installing KB5089549 (and KB5087051), some executables that perform or are associated with operations now considered sensitive may be treated as requiring elevation, causing:

A UAC prompt on launch, and
A shield overlay on their icons.

Because some similarly built applications do not show the issue, it is likely that only those performing or associated with newly protected operations are affected, rather than a blanket change to all applications.

For further troubleshooting, checking UAC settings (as suggested in a related case where users saw new UAC prompts after updates) may help confirm whether system-wide UAC configuration has changed.

References:

Share via

UAC popup appears for some self-developed applications after Windows Update

1 answer

Your answer