Windows UAC prompt becomes unresponsive after credential entry (Yes/No buttons do not function) – reproducible after idle/locked state, appears service-related

Question

Windows UAC prompt becomes unresponsive after credential entry (Yes/No buttons do not function) – reproducible after idle/locked state, appears service-related

Andrew C 25

Summary of the Issue

We are encountering a widespread, reproducible Windows UAC failure across multiple Windows 11 devices where the UAC consent dialog becomes unresponsive after credentials are entered.

Observed behavior:

User can enter username/password

Credentials appear to be accepted

“Yes”, “No”, and Close buttons are non-functional

Mouse and keyboard input stop responding within the UAC dialog

Dialog cannot be dismissed

Only recovery is CTRL+ALT+DEL → Restart (or waiting ~4–5 minutes for a timeout, with no elevation)

This impacts local admin elevation, credential prompts, and auto-elevation workflows, causing significant disruption to support and administrative operations.

Affected Environments

Windows 11 (Windows 10 not recently verified due to Win10 sunset)

Azure AD–joined and non-domain-joined systems

Occurs:

Locally at the device
During remote sessions

Independent of:

Application elevation allowlists
Manual vs auto-filled credentials
Presence of third-party elevation tools

Multiple organizations we support have reproduced this issue.

Reproduction Pattern

The issue does not occur immediately after reboot. A consistent pattern has emerged:

Reboot system → UAC works normally

System is left powered on, logged in, and locked for several hours or overnight

Upon attempting elevation:

UAC prompt appears
Credentials can be entered
Prompt becomes unresponsive

The issue persists until:

System reboot or

A specific background service is stopped (details below)

Key Observations

What temporarily restores UAC

Reboot

Stopping certain background services immediately restores UAC functionality

Restarting those services does not immediately reintroduce the issue

What does not resolve the issue

sfc /scannow (no integrity violations)

Group Policy (reproduced on non-domain-joined systems)

Ending or avoiding remote sessions

Removing third-party elevation tools

Service-Level Correlation

Through repeated controlled testing:

Stopping/Restarting any number of services immediately restores UAC
- DNS Filter Agent
- File Cache Service Agent (N-Able N-Central)
- PME Agent (N-Able N-Central)
Restarting the service does not instantly break UAC
Leaving the system locked/idle again can cause recurrence

This suggests a timing or state-related interaction rather than a persistent corruption.

Behavioral Details

Secure Desktop does render

Credential entry is accepted

UI interaction fails post-credential submission

Event Viewer:

No consistent crash events
No clear Application Errors tied to Consent.exe or ConsentUX
No obvious CPU or memory exhaustion at time of failure

Diagnostics Collected

Application and System Event Logs

Service-related process dumps (via ProcDump)

Time-correlated logs before and after service stoppage

No single crash signature or definitive fault has surfaced.

Current Blocker

Failure occurs within native Windows UAC (Secure Desktop)

Issue reproduces even without third-party elevation tools

Stopping specific third-party background services immediately restores native UAC

Unclear whether root cause is:

Windows subsystem interaction
Secure Desktop/session isolation issue
Application or driver-level bug

Similar behavior reported elsewhere:

Questions for the Microsoft Community

Are there known issues involving:

Secure Desktop input handling ConsentUX.exe
Winlogon or session transitions
Service-to-user session IPC

Are there recommended diagnostic tools beyond Event Viewer and ProcDump for UAC deadlocks?

Have recent cumulative updates introduced known UAC or session isolation regressions?

Has anyone observed similar behavior tied to:

Credential Providers
Network filter drivers
Background agents running as SYSTEM

Request

If anyone has:

Seen similar UAC freezes
Identified a root cause
Found a Microsoft hotfix or mitigation (registry or otherwise)
Insight into deeper UAC diagnostics

Any guidance would be greatly appreciated. We are actively gathering reproducible data and trying to determine whether this is a known Windows defect or an undocumented interaction.

Thank you for your time and expertise.

Andrew McEwen 0 Reputation points

2026-01-26T02:48:57.9033333+00:00

Just wanted to say that I have a client with the same issue.
Our client first reported the issue 2 months ago as an issue with Windows Hello prompts freezing up, we thought it was resolved following a SFC scan, but the issue has since gotten worse and is now affecting UAC like you have reported.
Interestingly we have a similar setup, with both DNS Filter and N-Able agents installed.
I'm going to see if I can uninstall DNS Filter and/or N-Able agents just to test if they are what is causing the issue. Then reinstall to test again.
I'll report back.
Andrew C 25 Reputation points

2026-01-26T13:02:36.9666667+00:00

Thank you, we are planning on doing similar testing as well. If you can report this issue to N-Able as well, this will let them know that it is not localized to our instance. They might be able to do more testing and determine if it is one of their tools. I will keep this updated as we know more.
Andrew C 25 Reputation points

2026-01-28T14:03:36.9533333+00:00

@Andrew McEwen ,we did some testing with uninstalling the N-Central Agent from problem devices which appears to have resolved the issue. Obviously this is not workable solution for the long-term, but if you have a case number I can provide to N-Able reporting the same issue, we would be able to share it with their support to have the cases linked for them to investigate further.
KTC_Church 21 Reputation points

2026-02-04T21:18:09.4733333+00:00

So thankful to have found this post! Thank you so much for the awesome details above! It describes THE EXACT issue a huge client of mine with 287 workstaions, has been experiencing on all their pcs. What I also noticed is that when the UAC dialogue box freezes, consent.exe or CredentialUIBroker.exe (both system32 processes) stop responding. My client uses Cyberfoxes Auto Elevate which I removed from 1 workstation but it didn't help. I'm testing the removal of Cynet AV solution but since you mentioned N-Able, I'll have to test that too as my client uses it. They have N-Able Windows Agent version 2025.4.1.2. MSP Core Agent version 3.27.5. My client's PCs are Windows 11 Pro or Business 25h2 build 26200.7623.

Can I also get that case number with N-Able if there is one so I can report the same issue? Or did either of you get it fixed yet?
Andrew C 25 Reputation points

2026-02-05T14:17:03.7966667+00:00

We are still trying to get N-Able to find a fix for this issue. So far, uninstalling the N-Central Agent and re-installing it is the only thing that has appears to have permanently resolved the issue on devices I have tested with (1 full week no errors on the test devices). Unfortunately, this makes fixing it on several hundred, or thousand devices rather impractical without a script.

When I asked support for a public case number, I was told:

Cases needed to be assigned to accounts such as yours. If other customers/partners intend to open a case regarding the same issue, they can open one from their end and our team should be able to locate related cases about it, such as this.

If it helps their team find related cases, I submitted mine with the title: "Windows UAC Prompt Cannot Proceed"
KTC_Church 21 Reputation points

2026-02-05T15:29:30.15+00:00

Thanks! I still need to test removing NC on my end too but im sure that will also fix it and then Ill create a ticket with NC also. Keep us posted here if you can.

3 answers

Your answer

Andrew McEwen 0 Reputation points

2026-01-26T02:48:57.9033333+00:00

Just wanted to say that I have a client with the same issue.
Our client first reported the issue 2 months ago as an issue with Windows Hello prompts freezing up, we thought it was resolved following a SFC scan, but the issue has since gotten worse and is now affecting UAC like you have reported.
Interestingly we have a similar setup, with both DNS Filter and N-Able agents installed.
I'm going to see if I can uninstall DNS Filter and/or N-Able agents just to test if they are what is causing the issue. Then reinstall to test again.
I'll report back.
Andrew C 25 Reputation points

2026-01-26T13:02:36.9666667+00:00

Thank you, we are planning on doing similar testing as well. If you can report this issue to N-Able as well, this will let them know that it is not localized to our instance. They might be able to do more testing and determine if it is one of their tools. I will keep this updated as we know more.
Andrew C 25 Reputation points

2026-01-28T14:03:36.9533333+00:00

@Andrew McEwen ,we did some testing with uninstalling the N-Central Agent from problem devices which appears to have resolved the issue. Obviously this is not workable solution for the long-term, but if you have a case number I can provide to N-Able reporting the same issue, we would be able to share it with their support to have the cases linked for them to investigate further.
KTC_Church 21 Reputation points

2026-02-04T21:18:09.4733333+00:00

So thankful to have found this post! Thank you so much for the awesome details above! It describes THE EXACT issue a huge client of mine with 287 workstaions, has been experiencing on all their pcs. What I also noticed is that when the UAC dialogue box freezes, consent.exe or CredentialUIBroker.exe (both system32 processes) stop responding. My client uses Cyberfoxes Auto Elevate which I removed from 1 workstation but it didn't help. I'm testing the removal of Cynet AV solution but since you mentioned N-Able, I'll have to test that too as my client uses it. They have N-Able Windows Agent version 2025.4.1.2. MSP Core Agent version 3.27.5. My client's PCs are Windows 11 Pro or Business 25h2 build 26200.7623.

Can I also get that case number with N-Able if there is one so I can report the same issue? Or did either of you get it fixed yet?
Andrew C 25 Reputation points

2026-02-05T14:17:03.7966667+00:00

We are still trying to get N-Able to find a fix for this issue. So far, uninstalling the N-Central Agent and re-installing it is the only thing that has appears to have permanently resolved the issue on devices I have tested with (1 full week no errors on the test devices). Unfortunately, this makes fixing it on several hundred, or thousand devices rather impractical without a script.

When I asked support for a public case number, I was told:

Cases needed to be assigned to accounts such as yours. If other customers/partners intend to open a case regarding the same issue, they can open one from their end and our team should be able to locate related cases about it, such as this.

If it helps their team find related cases, I submitted mine with the title: "Windows UAC Prompt Cannot Proceed"
KTC_Church 21 Reputation points

2026-02-05T15:29:30.15+00:00

Thanks! I still need to test removing NC on my end too but im sure that will also fix it and then Ill create a ticket with NC also. Keep us posted here if you can.

Answer 1

Chen Tran 12,765 Independent Advisor

Hello Andrew,

Thank you for posting question on Microsoft Windows Forum.

Based on the issue description. This behavior is probably a regression appearing in Windows 11 24H2 and systems patched with the August 2025 / January 2026 security updates. It is primarily a deadlock between the ConsentUX (Secure Desktop) process and background agents that hook into the Windows Installer (MSI) or Network Filtering (WFP) stacks.

The fact that stopping N-Able or DNS Filter services immediately restores functionality probably confirms a resource lock or IPC (Inter-Process Communication) deadlock.

The plausible explanation to the cause of the "Secure Desktop" Deadlock is of that the recent Windows security hardening (addressing CVE-2025-50173) has tightened how ConsentUX.exe handles credential validation. When you enter credentials, Consent.exe must communicate back to the calling session to spawn the elevated process. When a system has been idle, background agents (like N-Able’s PME Agent or DNS Filter) often initiate background maintenance, telemetry, or MSI repair checks. These agents often hold a handle on the Windows Installer database or a WFP network socket. When you trigger UAC, ConsentUX.exe attempts to verify the digital signature or certificate revocation list (CRL) of the calling app. If the background agent is blocking the network stack (DNS Filter) or the MSI service (PME), ConsentUX.exe enters a "Wait" state. Because it is running on the Secure Desktop, it blocks all input to that UI until the underlying check times out (the 4–5 minute delay you observed).

The following are some suggestions for mitigation.

To confirm this is a session-isolation hang, you can consider temporarily disabling the "Secure Desktop" mode via GPO or Registry. This will make UAC pop up on the regular user desktop. Navigate to this path HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Look for the value of PromptOnSecureDesktop and Set it to 0. Please note: This is a diagnostic step, not a permanent security recommendation.
Applying Known Issue Rollback (KIR). Since Microsoft has released a KIR for the UAC/MSI repair issues introduced in late 2025. Check if KB5063878 or KB5074109 (Jan 2026) is installed.
Try to analyze the "Wait Chain". When the UAC prompt freezes. On a different machine (or via a remote shell like ScreenConnect/Automate), run Resource Monitor. Go to the CPU tab and find ConsentUX.exe. Right-click it and select Analyze Wait Chain. It will probably show it is waiting on a SYSTEM-level service such as FileCacheServiceAgent.exe or dnsfilter.exe.

Last point to mention here is to monitor Microsoft’s release notes for post-August 2025 cumulative updates. As a fix is expected in upcoming patches.

You can consult the following article for more information regarding the issue.

https://windowsforum.com/threads/kb5065426-fixing-uac-msi-prompts-and-ndi-stutter-in-windows-11-24h2.380319

Hope the above information is helpful! If it is. Free feel to hit "Accepted" for benefitting others in community having the same issue too.

Chen Tran 12,765 Reputation points Independent Advisor

2026-01-23T12:04:52.98+00:00

Hi Andrew,

Hope you are doing well!

May I know the latest status of the query?

Hope the provided information is helpful! If it is. Free feel to hit "Accepted" for benefitting others in community having the same query too.
Andrew C 25 Reputation points

2026-01-23T14:18:18.6866667+00:00
Chen,

I reviewed your suggestions yesterday, and have been testing yesterday and today. More testing is needed though, as results are mixed.

I confirmed that KB5074109 is installed and present while the issue has been occurring this week. This was installed on the 18th, and I documented the issue occurring for several days after the machine had been restarted with the update installed.

I modified the registry key indicated yesterday and tested elevating programs to see the behavior that it should have when working normally as opposed to broken. This morning, I confirmed that even with the registry change, the issue was still occurring, but with a few differences.

Wait chain yesterday and this morning appeared the same. Consent.exe was not listed in the resource monitor until attempting to escalate a program.

UAC still froze, and in once instance produced an error after crashing: "File System Error (-805306369)

Allowing the UAC to remain idle would eventually launch the escalated program after timeout (results are mixed normally)

After multiple tests this morning, about 30 minutes in to investigating, the issue appeared to disappear. I did not intentionally stop any services this time, but something apparently changed for it to temporarily disappear. This is why additional testing is needed, as I expect it will reoccur after going through the normal "extended lock - unlock cycle".
Chen Tran 12,765 Reputation points Independent Advisor

2026-01-26T08:07:16.35+00:00

Hi Andrew,

Hope you are doing well!

May I know the latest status of your additional testing?

Hope some of the above suggestions are helpful! If it is. It is highly appreciated to hit "Accepted Answer".
Andrew C 25 Reputation points

2026-01-26T14:26:40.7966667+00:00

We are still doing testing. Since this is not currently the solution, I will not be accepting the answer yet. Thank you.
Andrew C 25 Reputation points

2026-01-28T13:58:30.9633333+00:00

Good morning, I have an update from my testing this week. I uninstalled the N-Central Agent from my device and confirmed this morning that the UAC error has disappeared. I will continue to test on my device to make sure it does not occur over the next several days. DNS Filter is still installed on my device. Please let me know what additional testing you would like me to perform, since it appears that N-Central is having issues with something that is causing the UAC prompt to freeze up, though there could be another app interaction we have not discovered yet.
Chen Tran 12,765 Reputation points Independent Advisor

2026-01-28T17:02:31.8133333+00:00

Hi Andrew,

That is great! After uninstalling the N-Central Agent from the device. The UAC error has disappeared. What to do now is to monitor it for the next few days to confirm that the UAC error has been permanently fixed.
TPIT 1 Reputation point

2026-02-27T14:15:20.9733333+00:00

Well i run in the same case!

Have the same issue at a Client.

They have Hybird & Intune but not N-Able.

At the moment i do not have root cause....

"Mouse and keyboard input stop responding within the UAC dialog"

But "outside" of the UAC its working?

Best regards!

Answer 2

Andrew C 25

The N-Able support team has finally confirmed that they believe N-Central is the issue. They provided us with the files for the N-Central code drop. We have scripted the process so that we can run it against multiple devices.

The script downloads an updated Framework.dll file and replaces the one currently installed with the agent. Our initial tests indicate this resolves the issue, but we still have to test on a large group of devices to confirm it resolves the issue across the board. We are hoping that this will get incorporated into the next quarterly maintenance to permanently resolve the issue.

KTC_Church 21 Reputation points

2026-03-02T21:53:43.4666667+00:00

That's great! Would you be able to share the framework.dll file or the script?

Andrew C 25

not sure this is the appropriate way to do it, but I could not upload a zip file directly (without renaming the extension). If you drop the .txt from the file, it's a zip folder with everything.

See script below: Code Drops.zip.txt

param(
    [switch]$Log
)
# ================================
# Configuration
# ================================
# ---- Version-Based URLs ----
$downloadUrl_2026 = #File Location "<YOUR FILE LOCATION>/Codedrop_FEB25_NCCF-1608593_2026.1.0.518/Framework.dll"   # 2026
$downloadUrl_2025 = #File Location "<YOUR FILE LOCATION>/Codedrop_FEB6_NCCF-1511813_2025.4.0.16/Framework.dll"   # 2025
$dllName     = "Framework.dll"  #Provided by N-Able
$targetDir   = "C:\Program Files (x86)\N-able Technologies\Windows Agent\bin"
$tempDir     = "C:\Temp"
$tempFile    = Join-Path $tempDir $dllName
$targetFile  = Join-Path $targetDir $dllName
$backupFile  = "$targetFile.old"
$agentPath   = Join-Path $targetDir "agent.exe"
# ================================
# Logging
# ================================
if ($Log) {
    $date = Get-Date -Format 'yyyyMMddHHmmss'
    if (!(Test-Path $tempDir)) {
        New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
    }
    $logPath = "$tempDir\Nable_DLL_Update_$date.log"
    Start-Transcript -Path $logPath -IncludeInvocationHeader
}
try {
    # ================================
    # Detect Agent Version
    # ================================
    if (!(Test-Path $agentPath)) {
        throw "agent.exe not found at expected path."
    }
    $ProductVersionRaw = (Get-Item $agentPath).VersionInfo.ProductVersion
    $ProductVersion    = [version]$ProductVersionRaw
    Write-Output "Detected Agent Version: $ProductVersion"
    if ($ProductVersion -eq "2026.1.0.518") {
        $downloadUrl = $downloadUrl_2026
        Write-Output "Using 2026 DLL package."
    }
    elseif($ProductVersion -eq "2025.4.0.16") {
        $downloadUrl = $downloadUrl_2025
        Write-Output "Using 2025 DLL package."
    }else {
        Throw "Agent version is not supported in this script."
    }
    if ([string]::IsNullOrWhiteSpace($downloadUrl)) {
        throw "Download URL is not defined."
    }
    # ================================
    # Stop Services
    # ================================
    Write-Output "Stopping Windows Agent services..."
    Stop-Service "Windows Agent Maintenance Service" -Force -ErrorAction Stop
    Stop-Service "Windows Agent Service" -Force -ErrorAction Stop
    Start-Sleep -Seconds 10
    # Ensure temp directory exists
    if (!(Test-Path $tempDir)) {
        New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
    }
    # ================================
    # Download DLL
    # ================================
    Write-Output "Downloading DLL to temporary location..."
    Invoke-WebRequest -Uri $downloadUrl -OutFile $tempFile -ErrorAction Stop
    if (!(Test-Path $tempFile) -or ((Get-Item $tempFile).Length -eq 0)) {
        throw "Download failed or file is empty."
    }
    Write-Output "Download validated."
    # ================================
    # Backup Existing DLL
    # ================================
    if (Test-Path $targetFile) {
        Write-Output "Creating backup of existing DLL..."
        Rename-Item -Path $targetFile -NewName "$dllName.old" -Force -ErrorAction Stop
    }
    # ================================
    # Replace DLL (with rollback)
    # ================================
    try {
        Write-Output "Copying new DLL into production directory..."
        Copy-Item -Path $tempFile -Destination $targetFile -Force -ErrorAction Stop
    }
    catch {
        Write-Error "Copy failed. Attempting rollback..."
        if (Test-Path $backupFile) {
            Rename-Item -Path $backupFile -NewName $dllName -Force
            Write-Output "Rollback successful."
        }
        throw "DLL replacement failed."
    }
    Unblock-File -Path $targetFile -ErrorAction SilentlyContinue
    # ================================
    # Restart Services
    # ================================
    Write-Output "Restarting services..."
    Start-Service "Windows Agent Maintenance Service"
    Start-Service "Windows Agent Service"
    Write-Output "Update completed successfully."
}
catch {
    Write-Error "ERROR: $_"
}
finally {
    # Ensure services are running
    if ((Get-Service "Windows Agent Service").Status -ne "Running") {
        Start-Service "Windows Agent Service" -ErrorAction SilentlyContinue
    }
    if ((Get-Service "Windows Agent Maintenance Service").Status -ne "Running") {
        Start-Service "Windows Agent Maintenance Service" -ErrorAction SilentlyContinue
    }
    if ($Log) {
        Stop-Transcript
    }
}

KTC_Church 21 Reputation points

2026-03-03T20:46:30.8866667+00:00

thank you so much! we'll try it out.
KTC_Church 21 Reputation points

2026-03-06T18:21:13.7366667+00:00

Can you confirm what version of windows agent this is for or maybe it doesnt matter. I ask because there are two folders in your code drops zip. One looks like four version 2025.4.0.16 and another possibly for version 2026.1.0.518 but the latest Windows agent from the vendor is 2025.4.1.2 which is the version we have installed for our clients.
Andrew C 25 Reputation points

2026-03-09T13:23:45.5133333+00:00

These are specifically for the two windows agent versions: 2025.4.0.16 and the newest 2026.1.0.518. We are on a cloud hosted version which has the 2026 update, while I think the 2025.4.1.2 is a self hosted version, if I am not mistaken. You may have to get a specific code drop from them that supports this version.

Answer 3

The issue you are experiencing with the Windows UAC prompt becoming unresponsive after entering credentials appears to be a complex problem that affects multiple Windows 11 devices, particularly in scenarios involving idle or locked states. Based on your description, it seems that the problem is reproducible across different environments, including Azure AD-joined and non-domain-joined systems.

Key Observations:

The UAC prompt works normally immediately after a reboot but becomes unresponsive after the system has been idle for an extended period.
Stopping certain background services temporarily restores UAC functionality, suggesting a potential interaction issue rather than a persistent corruption.
The problem does not seem to be resolved by common troubleshooting steps such as running sfc /scannow, modifying Group Policy, or removing third-party elevation tools.

Potential Areas to Investigate:

Service Interactions: Since stopping specific services (like the DNS Filter Agent or N-Able N-Central services) restores UAC functionality, it may be beneficial to investigate the interactions between these services and the UAC process.
Secure Desktop Handling: There may be issues related to how the Secure Desktop handles input after a period of inactivity, which could be linked to session isolation or transitions.
Event Viewer Logs: Although you mentioned no consistent crash events, continuing to monitor the Event Viewer for any anomalies during the times the issue occurs may provide additional insights.

Recommendations:

Gather More Data: Continue collecting reproducible data and logs, particularly focusing on the state of services and processes at the time the UAC prompt becomes unresponsive.
Community Engagement: Engaging with the Microsoft community, as you have started, may yield insights from others who have faced similar issues. It may also be worth checking for any recent updates or hotfixes that could address UAC or session isolation issues.

This situation appears to be a known issue affecting UAC functionality in Windows 11, and further investigation into the service interactions and potential updates from Microsoft may be necessary to resolve it.

References:

Windows UAC prompt becomes unresponsive after credential entry (Yes/No buttons do not function) – reproducible after idle/locked state, appears service-related

Summary of the Issue

Affected Environments

Reproduction Pattern

Key Observations

What temporarily restores UAC

What does not resolve the issue

Service-Level Correlation

Behavioral Details

Diagnostics Collected

Current Blocker

Related Reports

Questions for the Microsoft Community

Request

3 answers

Key Observations:

Potential Areas to Investigate:

Recommendations:

Your answer