User Account Control - UAC - Change Notification Settings

Only an administrator can do that. If that's not an option for you, then you may need to reinstall.

konlo1 said:

I had a trojan a while ago that disabled UAC. Now I don't get the prompt window for anything. Even if I do run as administrator. I use standard, but know admin pass. I cant access the control panel, and the file gave me this error. "Cannot import c:\users\username\desktop\UAC_Level-1.reg: Not all data was succesfully written to the registry. Some keys are open by the system or other processes" Please help, I need to be prompted for admin password to... well, do anything.

Please post in the security/malware removal forum here:

System Security - Windows 7 Help Forums

Please include a new thread there explaining your issue in as much detail as possible. We will be happy to help.

Of the 4 or so [.reg file] configuration options given here, none of them seem to have both the secure desktop off while maintaining UAC's security rating at its highest level, which is not only possible but surely preferable for most users.

This configuration works best if your user is a member of the Administrators group, in which case UAC prompts are predictable and unobtrusive (one extra click to perform an administrative action).

Now I don't know if my registry settings will work with all versions of Windows 7, but I don't see why they wouldn't.

==============================
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000004
"ConsentPromptBehaviorUser"=dword:00000003
"PromptOnSecureDesktop"=dword:00000000
==============================

I think those are the only relevant ones in this context.


As an administrator if you click on "Administrator Tools" for instance, your consent will be prompted for, without any switching of desktops. So it is instant and amounts to a single (and expected) extra confirmation click.

Your overall security rating goes up to level 4 while UAC prompts are predictable and unobtrusive. For instance I have a quick launch icon for an administrator-level command prompt. To open it up requires two clicks (basically one to launch and another "are you sure?"). Additionally, the UAC prompt not centered on some dark desktop, but appears right beside the icon I just clicked. Not annoying at all.

But now, see that's still a level 4 security rating config because you don't NEED the secure desktop when all administrative actions require confirmation. And I only use the control panel every now and again. For other administrative things I have my quicklaunch to "Admin: cmd.exe" (You can use "taskbar quicklaunch" or start menu "pinned links" in a similar way).

- Alan

Hello Alan, and welcome to Seven Forums. :)

The .reg files in this tutorial are only to make the same default settings from the UI.

The tutorial below for the dimmed secure desktop mode can be set in addition with it.

User Account Control (UAC) - Blacking Out of Screen

Well maybe I missed something because I looked at that tutorial prior to making my post, just to be sure, and (correct me if I am wrong) but the overall security rating after making those changes is only at level 2 instead of level 4 where it should be.

- Alan

P.S. Oh, and thanks for welcoming me in! :)

Nar, you didn't miss anything. Those are separate as well. :)

How to Elevate All Administrator Accounts UAC Privilege Level

How to Change Behavior of User Account Control (UAC) Prompt for Standard Users

Just to be sure, assuming you have Local Security Policy manager on your system, this image shows my setup which is the one I actually prefer even though it happens to push my overall security status to the highest level:



I will definitely turn off the auto-detection of install programs and prompt bug (ie. feature) I just discovered taking that screenshot ... but that's only because I can. The average user will not know how to do it and will, very unfortunately, become habituated to allowing "God Mode" for all software installations.

Well I shouldn't say "all". In fact I just compiled an installer using Inno Setup and it does not use, require nor invoke God Mode prior to installation.

Works great!

- Alan

The one you have circled in green is to enable/disable giving a UAC prompt when users try to install a program that requires elevation to do so.

Of course, the downside to being logged in to an account that has been elevated without any restrictions is that anything that runs (ex: malware in the background) will also have the same unrestricted access to everything on the PC. You'll never know since you don't get any prompts by UAC for your approval when anything tries to run or open anything that requires elevated rights.

You are right, I tried it and it didn't help. In fact that's only part of what I wanted disabled. There's a very strange bug that exists in Win 7 and I'm not sure if it's new or nobody noticed. And that's the following:

Take *any* program (particularly one that is not an install program and rename it so that the word "setup" appears in the file name. For example hellosetupworld.exe for *any* program (except a real installer).

If you do that a little shield appears with the program's icon and when you try to run what would otherwise be an innocuous unit test that tries (and would normally fail) to make some global system change, instead you get the UAC prompt for which you will click yes (ever clicked no?) and it will have acquired Admin access to your system and install a rootkit or whatever it wants to do. Trusted Installer is more on the level of NT Authority System than a regular old Administrator.

- Alan