User Account Control: Behavior of the elevation prompt for standard users
A `REG_DWORD` value of `1` causes Windows to display a credential prompt on the secure desktop when a standard user initiates an operation that requests elevation to administrative privileges.
since 0.9.8.11
Purpose
Security policy: [Registry Values] MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = 4,1
A REG_DWORD value of 1 causes Windows to display a credential prompt on the secure desktop when a standard user initiates an operation that requests elevation to administrative privileges. The user must supply the user name and password of a suitably privileged account. Windows continues the operation with the applicable elevated privileges only after those credentials have been validated.
Unlike the value 0, this setting does not automatically deny elevation requests. It does not permanently grant the signed-in standard user administrative status or additional access to files, the registry, or other system resources.
Notes
Security
The secure desktop isolates the credential prompt from the ordinary interactive desktop. Only trusted Windows processes can directly access this desktop, making it more difficult for ordinary applications to alter or interact with the genuine prompt.
Because this setting permits elevation after valid administrative credentials are supplied, a standard user can perform an administrative operation if the user knows such credentials or an administrator enters them. Approving an elevation request from an untrusted application allows that application to use the granted administrative privileges to modify the system.
Possible side effects
Switching to the secure desktop temporarily interrupts interaction with the normal desktop. Some remote assistance and accessibility workflows might be unable to interact with the prompt unless access to the secure desktop is permitted by additional UAC settings.
Notes
This setting controls only the elevation-prompt behavior for standard users. It does not change account memberships or bypass the authorization checks for the requested operation. Elevation does not occur without valid credentials for an account that has sufficient privileges.
User Account Control must be active for this setting to take effect. If the UAC policy mechanism is disabled through EnableLUA, the related UAC settings do not apply.
Microsoft documentation
Microsoft Learn: User Account Control settings and configuration
Microsoft Learn: How User Account Control works