User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
The DWORD value `2` specifies that administrators operating in Admin Approval Mode must explicitly approve or deny an elevation request on the secure desktop.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
The DWORD value 2 specifies that administrators operating in Admin Approval Mode must explicitly approve or deny an elevation request on the secure desktop. The UAC prompt presents a Yes-or-No consent choice and does not require the administrator to enter credentials.
If consent is given, the operation continues with the highest privilege available to that administrator account. If consent is denied, the operation is not elevated.
Notes
Security
Requiring consent prevents an operation that requests elevation from proceeding for the affected administrator account without confirmation. Unlike the default “Prompt for consent for non-Windows binaries” option, this value is not limited to non-Windows applications.
The secure desktop is isolated from the normal interactive desktop and is accessible only to trusted Windows processes. This makes it more difficult for a process running on the user desktop to interfere with the genuine UAC prompt or automate approval. Protection still depends on the administrator’s decision: approving the request allows the requesting process to run with elevated privileges.
Possible side effects
Administrators encounter UAC prompts more frequently when operations require elevation. While the prompt is displayed on the secure desktop, the normal desktop is dimmed and cannot be used until the request is approved or denied.
Clipboard content cannot be pasted on the secure desktop on supported Windows client versions or on Windows Server 2019 and later.
Notes
This value controls prompt behavior only for administrator accounts in Admin Approval Mode. It does not change prompt behavior for standard users or alter the privileges assigned to an account.
Admin Approval Mode must be active through the related UAC settings for this value to take effect. If Admin Approval Mode is disabled, ConsentPromptBehaviorAdmin has no independent effect.
Microsoft documentation
Microsoft Learn: User Account Control settings and configuration
Microsoft Learn: How User Account Control works