UAC will not elevate after credentials entered

Question

UAC will not elevate
This issue is happening on all Windows 10 systems 1909 and 20H2. I have tried DISM repairs, new profiles, a fresh image, a fresh image with no group policy. It will work for about an hour after each reboot, but then it starts to fail again.

Users operate under standard domain user accounts.

When I try to elevate a program using UAC it fails.

The UAC prompt box will appear, take my username and password, and then the screen stays as a muted darkened version of my blank wallpaper.

The PC will sit like this for a 2 minutes and then go back to the desktop without the elevated permission ever happening.

If I press Ctrl-Alt-Del and just cancel out of the task manager I can get the desktop to operate again but the permission elevation dose not happen.

Similarly, I cannot seem to do "Switch User" after an hour as well, the will spin until I have to hard reboot.

And my Group Policies will stop applying and I'll receive an "Access Denied" unless i reboot as well.

Answer 1

Have you reviewed the Security and System event logs? If UAC is failing there should be some event logged.

Build a new Win10 VM. Don't join it to your domain. Don't install any 3rd party applications. Just use local accounts to test UAC. Create 2 users, TestUser and Administrator. Log in as TestUser and verify that UAC will accept the Administrator account's credentials. Reboot, wait an hour, do whatever. Test UAC again to verify that it still works.

Then join the VM to the domain. Log in as the local TestUser and test to see if UAC still works with the local accounts.

Then log in with a domain account and see if UAC still works with the Administrator account.

If the UAC problem shows up, then sit down with your Active Directory Administrator and review the group policy settings on the VM.

Answer 2

Hi there,

If you have enabled the built-in Administrator account and have configured Admin Approval Mode, you must also configure the option Prompt for consent on the secure desktop. You can also configure this option from User Account Control, by typing UAC in the search box. From the User Account Control Settings dialog box, set the slider control to Notify me only when apps try to make changes to my computer.

It is best practice to select the option Elevate without prompting minimizes the protection that is provided by UAC.

You can get more info from here https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode

---------------------------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--