User Account Control: Behavior of the elevation prompt for standard users
The `ConsentPromptBehaviorUser` DWORD value controls how User Account Control responds when a standard user initiates an operation that requires elevation.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser
The ConsentPromptBehaviorUser DWORD value controls how User Account Control responds when a standard user initiates an operation that requires elevation.
A value of 1 selects Prompt for credentials on the secure desktop. Windows switches to the secure desktop and requests credentials for an administrator account. The requested operation continues with that account's applicable privileges only after valid administrative credentials have been supplied.
This setting does not add the signed-in standard user to an administrative group or grant that user permanent, general administrative rights. Elevation applies to the authorized operation or resulting elevated process.
Notes
Security
The secure desktop is isolated from the normal interactive user desktop and can be accessed only by Windows processes. This makes it more difficult for ordinary applications running on the user desktop to manipulate the credential prompt or intercept administrative credentials entered into it.
The setting does not prevent a user who possesses administrative credentials from elevating a malicious or mistakenly launched application. After successful authentication, the affected process receives the privileges associated with the administrator account that was supplied.
Possible side effects
Standard users can continue with applications or system functions that require elevation only when suitable administrator credentials are available. Without valid credentials, the operation cannot proceed with elevated privileges.
Windows dims and temporarily blocks the interactive desktop while the prompt is displayed. Remote-assistance and accessibility software can interact with the secure desktop only as permitted by the applicable UIAccess and UAC policies, so a remote session might be paused while the prompt is active.
Notes
This behavior is part of User Account Control and depends on Admin Approval Mode and UAC not being disabled by other system settings. Other UAC policies—particularly those governing the secure desktop and UIAccess applications—can further affect elevation-prompt behavior.
Microsoft documents this setting for Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025.
Microsoft documentation
Microsoft Learn: User Account Control settings and configuration
Microsoft Learn: How User Account Control works