Irritating UAC Behavior in Win11 vs. Win10

Question

Irritating UAC Behavior in Win11 vs. Win10

Dan Smith 0

In Windows 10, when requesting to run an application as an elevated administrator, we have our GPO set to "Prompt for credentials on the secure desktop". The result is we're immediately shown a prompt asking for a username and a password.

In Windows 11, when doing the same as above (with the same GPO settings applied), we need to perform additional clicks in order to get to the same username/password prompt. First, you need to click "More Choices", then you need to click "Use a different account", THEN you're shown the prompt:

User's image

So, here's the list of possible values for "ConsentPromptBehavior". We're testing w/23H2 and it seems that Windows 11 simply ignores whatever value we've tested with:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System "ConsentPromptBehaviorAdmin"
0 = "Elevate without prompting"
1 = "Prompt for credentials on the secure desktop" (this is our current config)
2 = "Prompt for consent on the secure desktop"
3 = "Prompt for credentials"
4 = "Prompt for consent"
5 = "Prompt for consent for non-Windows binaries (Windows default)"

To make sure this wasn't due to some other GPO setting, I spun up an OEM copy of Windows 11 23H2 and left it disjoined from our domain. I then manually set the value of "ConsentPromptBehaviorAdmin" from 0 thru 5 (with a reboot in between) in order to test the out of the box behavior of the UAC prompts. For each value applied, the behavior/appearance of the UAC prompt did not change.

Finally, I updated to the latest canary build of Windows 11 (25992.rs_prerelease.231103-1529) and then tested again, still no effect.

Otto Hedeby 26 Reputation points

2023-11-14T20:10:23.1+00:00

Hi Dan,

Interesting behaviour that caught my attention.

Have you tested this behaviour on earlier versions of Windows 11? 22H2 for example? Is the UAC prompts the same?
Dan Smith 0 Reputation points

2023-11-14T21:06:54.54+00:00

Yes, this is also happening on builds 21H2 as well as 22H2.

As a sysadmin who frequently uses the elevated run-as commands, this is really irksome.
Otto Hedeby 26 Reputation points

2023-11-16T19:58:33.7966667+00:00

Excuse me for my delayed answer. I was at the customer that is on their journey to Windows 11 but I didn't have the time to test this and check if they get the same behaviour.

I think during the testing period with Windows 11, at least 22H2 when we tested, I think I got the same behaviour as you do. I won't have a PC that I can truly test this scenario until next week. On the documentation of the UAC, Microsoft have some pictures based on different settings and on the prompt for credentials, they seem to accomplish what you are trying to.
https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works#the-credential-prompt

1 answer

Your answer

Otto Hedeby 26 Reputation points

2023-11-14T20:10:23.1+00:00

Hi Dan,

Interesting behaviour that caught my attention.

Have you tested this behaviour on earlier versions of Windows 11? 22H2 for example? Is the UAC prompts the same?
Dan Smith 0 Reputation points

2023-11-14T21:06:54.54+00:00

Yes, this is also happening on builds 21H2 as well as 22H2.

As a sysadmin who frequently uses the elevated run-as commands, this is really irksome.
Otto Hedeby 26 Reputation points

2023-11-16T19:58:33.7966667+00:00

Excuse me for my delayed answer. I was at the customer that is on their journey to Windows 11 but I didn't have the time to test this and check if they get the same behaviour.

I think during the testing period with Windows 11, at least 22H2 when we tested, I think I got the same behaviour as you do. I won't have a PC that I can truly test this scenario until next week. On the documentation of the UAC, Microsoft have some pictures based on different settings and on the prompt for credentials, they seem to accomplish what you are trying to.
https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works#the-credential-prompt

Answer 1

It seems you've encountered a significant change in the User Account Control (UAC) behavior from Windows 10 to Windows 11. This change, where additional clicks are required to reach the username/password prompt, can be frustrating, especially in an environment where quick access to elevated privileges is necessary.

Unfortunately, if you've already tested the various ConsentPromptBehaviorAdmin values in the Registry and found no change in the UAC prompt behavior in Windows 11, it suggests that this behavior might be a built-in feature or limitation of the newer OS.

Considering that you've also tested this on the latest canary build without any effect, the behavior you're experiencing could be by design in Windows 11. Since these settings are not affecting the UAC behavior as expected, your options might be limited.

You could:

Provide Feedback to Microsoft: Since this is an issue that affects productivity, especially in a managed environment, providing feedback to Microsoft through their feedback hub or support channels might bring attention to this issue.

Seek Workarounds: Look for potential workarounds or third-party tools that might offer a quicker way to achieve elevated privileges without going through the additional clicks.

Stay Updated: Keep an eye on future Windows 11 updates or patches that might address this change in UAC behavior.

Unfortunately, without a direct fix or setting adjustment available, these might be your most viable options.

Gerolf Holenia 0 Reputation points

2025-04-30T11:54:58.64+00:00

Hi all,

We suddenly have the same issue, just that we can't choose a different user. If you only use LAPS and the local administrator user and you have the Administrator Password thats fine. But if you have also users in local Admin role in Intune that blocks the whole setup. Is there some workaround?

We are on 24H2 with that client:

Thanks BR Gerolf

Share via

Irritating UAC Behavior in Win11 vs. Win10

1 answer

Your answer