User Account Control Policies
You can customize User
Account Control to a certain extent by using group policies. In the
Local Security Settings snap-in (select Start, type secpol.msc,
and then press Enter), open the Security Settings, Local Policies,
Security Options branch. Here you’ll find nine policies related to User
Account Control (as shown in Figure 4).
User Account Control: Admin Approval Mode for the Built-In Administrator Account—
This policy controls whether the Administrator account falls under User
Account Control. If you enable this policy, the Administrator account
is treated like any other account in the Administrators group and must
click Continue in the consent dialog box when Windows 7 requires
approval for an action.
User Account Control: Allow UIAccess Applications to Prompt for Elevation Without Using the Secure Desktop—
Use this policy to enable or disable whether Windows 7 allows elevation
for accessibility applications that require access to the user
interface of another window without using the secure desktop mode.
User Account Control: Behavior of the Elevation Prompt for Administrators in Admin Approval Mode—
This policy controls the prompt that appears when an administrator
requires elevated privileges. The default setting is Prompt for Consent,
where the user clicks either Continue or Cancel. You can also choose
Prompt for Credentials to force the user to type his or her password. If
you choose No Prompt, administrators cannot elevate their privileges.
User Account Control: Behavior of the Elevation Prompt for Standard Users—
This policy controls the prompt that appears when a standard user
requires elevated privileges.
User Account Control: Detect Application Installations and Prompt for Elevation— Use this policy to enable or disable automatic privilege elevation while installing programs.
User Account Control: Only Elevate Executables That Are Signed and Validated—
Use this policy to enable or disable whether Windows 7 checks the
security signature of any program that asks for elevated privileges.
User Account Control: Only Elevate UIAccess Applications That Are Installed in Secure Locations—
Use this policy to enable or disable whether Windows 7 allows elevation
for accessibility applications that require access to the user
interface of another window only if they are installed in a secure
location (such as the %ProgramFiles% folder).
User Account Control: Run All Administrators in Admin Approval Mode— Use this policy to enable or disable running administrators (excluding the Administrator account) as standard users.
User Account Control: Switch to the Secure Desktop When Prompting for Elevation— Use this policy to enable or disable whether Windows 7 switches to the secure desktop when the elevation prompts appear.
User Account Control: Virtualize File and Registry Write Failures to Per-User Locations— Use this policy to enable or disable file and Registry virtualization for standard users.
