How to enable or disable UAC in Windows Vista

User account control (UAC) is a new security model utilized by Microsoft in Windows Vista.  In earlier versions of Windows, a user with administrative privileges always had the privilege to do anything they wanted to the computer at any time.  The problem with this is that any program, virus, or piece of malware which tried to run while this user was logged in was immediately given rights to do anything it wanted to do.  UAC is Microsoft’s answer to this problem.  Users with administrative privileges run as standard users under normal conditions, but when administrative rights are necessary the user is prompted to provide authorization.  Under this model, if a virus tried to install itself, it would pop up a dialog to the user informing them of the program that needed administrative rights.  The idea then is that the user would ostensibly recognize the program as something they didn’t want to run, deny the escalation of privileges, and keep the virus from executing.  It’s not perfect, but it’s a good step forward.

Occasionally all of the extra prompts can get annoying; for instance, when you’re building an image and need to install lots of known software, make setting changes, etc.  In this situation there’s very little risk to the system, and clicking a popup every few minutes wears on the nerves.  There is also some software that won’t install without user account control being turned off first (McAfee’s EPO in our environment) because of the restrictions that UAC places on writing to protected system files and directories.  If that’s the case, here’s how you can disable UAC the long way:

1. As an administrative user, open the Control Panel.
2. Click on User Accounts.
   
3. Click on the User Accounts Link .
   
4. Click on “Turn User Account Control on or off”.
    
5. In the box that opens, check the box to turn UAC on, or uncheck the box to turn it off, then click OK.
   
6. Reboot.

Or if you prefer the short 3 step method:

1. From the start menu search box or the run command, type “msconfig” to open the system configuration utility.
2. On the tools tab, click either “Enable UAC” or “Disable UAC” depending on what you’re trying to do, then click launch.
   
3. Reboot.

You may notice in the bottom of the system configuration utility when you clicked on either enable or disable UAC, the command line version of the tool you’re running shows up.  This may come in handy for writing scripts or being able to turn UAC on or off remotely.

The command line to disable UAC is: C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
To enable it, the command line is: C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f