Make Vista's User Account Control Work for You

Maintain your PC's protection without the incessant UAC interruptions.

Without any question, the most annoying feature in Windows Vista--and that's saying something--is User Account Control (UAC). If the system gatekeeper just wanted my permission to install software, it would be easier to tolerate. But UAC doesn't stop there. Just try to add, remove, or rename any of your Start menu folders, or to set your system clock. Any such attempt involving various common, everyday, and relatively safe tasks will cause your screen to go dark, after which a scary confirmation prompt pops up, requiring an extra click.

One solution is to turn UAC completely off. To do that, choose Start, Control Panel, click User Accounts and Family Safety, and select User Accounts. Or just click Start, type User Accounts, and choose that option from the search results. Next, click Turn User Account Control on or off, and then click Continue when prompted by (what else?) UAC itself. Uncheck the box, and click OK. Choose a restart option when prompted to do so. After you restart, you'll no longer be bothered by UAC prompts.

Of course, this simple method puts your computer at much greater risk, especially if you routinely log on as an administrator. So in this article I'll outline some more-nuanced ways to keep UAC at bay while keeping your guard up.

One option is to leave UAC on for most of your routine computing, but to turn it off when you need to do serious customizing, such as working with Control Panel applets or installing new software. Toggling UAC takes several steps, but you can streamline the process by creating a batch file to turn UAC off and another batch file to turn it back on. Unfortunately, each process requires a restart, but at least you can make that process part of the batch file.

Open Notepad or your favorite text editor. On the first line, type %windir%\System32\reg.exe ADD HKLM\SOFTWARE\ Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f (with no space between "SOFTWARE\" and "Microsoft\"), and press Enter. This command shuts down UAC. On the next line, type shutdown /r /t 20 /c "Restarting your system in 20 seconds. To cancel, choose Start, type shutdown /a and press Enter", and press Enter again. This line restarts your computer in 20 seconds and includes instructions on how to cancel the restart if necessary. You can change the '20' value to whatever number of seconds you prefer. Next, choose File, Save As; specify a location; and type a name for the file, giving it the .cmd extension.

Next, create a shortcut to the file you just created: Locate the icon for the file, and hold down the right mouse button as you drag the icon to a desired location; then release the button, and select Create Shortcuts Here. Right-click the shortcut and choose Properties. In the Shortcut tab, click the Advanced button. Check Run as administrator, and click OK twice (see the screen below). In the future, when you launch the shortcut, UAC will still prompt you (since it will still be on), but at least you'll have enough privileges to run the batch file after confirming.

Simplify your control over User Account Control by creating a batch file shortcut designed to let you easily switch to running your system as an administrator. Once you've created this shortcut, you'll be able to toggle UAC on and off with only one attempt by the Vista control watchdog to intervene.

To create a batch file for turning UAC back on, return to Notepad and click File, New. Type %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\ CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f (with no space between "System32" and "\reg.exe" and with no space between "Windows\" and "CurrentVersion\"), and press Enter. On the second line, type the same second line as in the earlier batch file for turning UAC off; this adds the restart feature. Next, save the file with the .cmd extension. Because you'll be running this batch file when UAC is turned off, you won't need to create a shortcut and endow it with administrative powers (as you did with the first batch file). Just launch the batch file directly when you want to reactivate UAC, and let it restart your computer.

Because both batch files restart your system, it's a good idea to save all of your work before you launch either of them. Normally, your apps should prompt you to save open work as part of the shutdown process, but it never hurts to do this beforehand, just in case.

If you really can't stand UAC, consider logging in to your system using a nonadministrator account. The less privileged the profile you use to log in, the more secure your PC will be.

One way to demote an existing account is to use the Local Users and Groups administrative tool (lusrmgr.msc) as explained in tip 19 of "76 Ways to Get More Out of Windows." Vista Home and Vista Home Premium lack this tool; so if you're running one of them, click Start, type User Accounts, and choose that item from the search results. Make sure that your system has at least one administrator account you can log into. Select Manage another account to demote a profile other than the one you're currently logged into. Confirm the command when UAC prompts you to do so. Select the administrator account that you want to demote, click Change the account type, select Standard user, and choose Change Account Type (see the image below).

For safer computing, demote an extra account to the level of a standard user and log in there whenever you plan to do general-purpose work on your Vista PC. Because you'll be working as a less-privileged computer user, you weon't be able to do things that trigger UAC's interest (and interference).

From now on, use this less-privileged account for your daily computing. When you need to install or run an application as an administrator, right-click its .exe file or shortcut and choose Run as administrator. This command won't be on the context menu for shortcuts pinned to the main Start menu, but if you click All programs and right-click its shortcut there, you'll see the command. After you select it, you'll be prompted for the account name and password under which to run the program.

You can also combine this tip and the next one for occasions when you need to run several apps as an administrator without logging out of your limited account.

Another approach is to keep UAC running but use a special command prompt with elevated privileges when you have a lot of system chores to do. Such a prompt lets you launch applications and issue commands without constantly triggering UAC confirmation prompts.

First, create a shortcut to the command prompt (cmd.exe): Locate the Command Prompt shortcut in Start, All Programs, Accessories, and use the right-mouse button to drag it to a location of your choice. Release the mouse button and choose Copy Here. (This keeps the normal Command Prompt on the Accessories menu unchanged.) Right-click your new shortcut and choose Properties. On the Shortcut tab, click Advanced. Check Run as administrator, and click OK.

Because this prompt can launch applications and perform other functions without any UAC prompts, it's a good idea to give it special colors to remind you of the risks involved and to help you avoid mistaking it for an ordinary command prompt. Click the Colors tab and use the controls there to set the colors for 'Screen text', 'Screen background', and other items, as desired (see the image below). Click OK. The changes may affect your default command prompt window as well; if so, you can change those settings back to their default values the next time you open that prompt, and the problem should not return.

Use special screen-text and screen-background colors for your power prompt to distinguish it from a command window with normal privileges.

The next you need to do system-related chores, launch your special power prompt. You'll still have to provide one UAC confirmation when you first open the power prompt. But tasks that you perform from within this prompt--such as creating or renaming folders on the Start menu, launching disk utilities, and running installers--will be UAC prompt-free.

A more granular approach to UAC is available too. Though the User Accounts Control Panel limits you to turning UAC on or off, you can do a bit of fine-tuning via the Group Policy Object Editor. Click Start, type gpedit.msc, and press Enter. Confirm that decision when UAC prompts you to do so. In the tree pane on the left, navigate to Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. With Security Options selected in the left pane, scroll down the right pane to the User Account Control options.

These settings are anything but clear, but you can do a couple of useful things with them. For example, if you don't mind receiving UAC prompts for most tasks but you want to be able to install software without any UAC nagging, double-click User Account Control: Detect application installations and prompt for elevation. Select Disabled and click OK. Restart your computer to see the change.

Another possibility is to leave UAC turned on but set it to knock off the prompts. Unlike turning off UAC altogether, suppressing prompts preserves the "protected mode" security feature of Internet Explorer that UAC confers. Of course, turning off the prompts is considerably riskier than retaining the default settings, but it's better than disabling the entire applet. To take this approach, double-click User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode. Choose Elevate without prompting from the dropdown list, and click OK (see the image below). A pop-up will complain that UAC is not on, but you can ignore it.

Fine-tune your User Account Control interactions by adjusting settings in the Group Policy Object Editor to suppress the prompts that User Account Control wants to pepper you with. The resulting "protected mode" isn't as safe as leaving the default UAC settings in place, but it's a lot more peaceful.

Vista Home Premium doesn't have the Group Policy Editor. To make the change in that version, you must edit the Registry. Before attempting any Registry changes, back it up following the instructions in "Block Spying Cookies, but Keep the Helpful Ones" (scroll down to the blue text box near the bottom of the page). With your Registry backup in place, click Start, type regedit, and press Enter. In the tree pane on the left, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\Policies\System. With the System icon selected in the left pane, double-click ConsentPromptBehaviorAdmin in the right pane. Change the Value data to 0 and click OK. You should see the effect immediately (no restart required).

Scott Dunn