User Account Control: Run all administrators in Admin Approval Mode
The `EnableLUA` DWORD value controls whether User Account Control (UAC) and Admin Approval Mode are enabled system-wide.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
The EnableLUA DWORD value controls whether User Account Control (UAC) and Admin Approval Mode are enabled system-wide. A value of 1 enables these features.
Members of the local Administrators group normally run ordinary applications with a filtered access token instead of their full administrative permissions. When an operation requires elevation, Windows can start a process with the administrative access token. Whether this produces a consent or credential prompt depends on the other UAC security options.
This setting does not remove Administrators group membership or its associated rights. It separates routine application execution from processes that are explicitly elevated.
Notes
Additional effects
EnableLUA=1 is a fundamental prerequisite for related UAC policies and features. These include configurable elevation-prompt behavior, detection of certain application installers, and file and registry virtualization for eligible legacy applications. Whether each feature is actually used depends on additional UAC settings and on the characteristics of the application.
For the built-in Administrator account, EnableLUA alone does not fully determine whether the account operates with a filtered access token. Its behavior is also affected by the separate “User Account Control: Admin Approval Mode for the Built-in Administrator account” security option and the FilterAdministratorToken registry value.
Security
Separating the filtered standard access token from the administrative access token limits the permissions available to applications running in an administrator's normal user context. Code that is started unintentionally or maliciously therefore does not immediately receive administrative execution rights merely because the signed-in user belongs to the Administrators group.
UAC is not a security boundary and does not prevent every possible privilege elevation. If an administrator approves an elevation request, the affected process runs with the available administrative permissions. The resulting level of protection therefore also depends on the other UAC policies and on how elevation requests are handled.
Possible side effects
Administrative programs and tasks can require elevation and, depending on the other UAC settings, can display an elevation prompt. Legacy applications that attempt to write to protected system locations without suitable manifests or permissions can behave differently. Any file and registry virtualization available to such applications depends on separate settings and application eligibility.
Notes
EnableLUA is a computer-wide DWORD value. A change to this setting does not take full effect until the computer is restarted.
The value 1 enables the underlying UAC model but does not by itself determine how individual elevation requests are handled or displayed. Those behaviors are controlled by the applicable UAC security options.
Microsoft documentation
Microsoft Learn: User Account Control settings and configuration
Microsoft Learn: Policy CSP – LocalPoliciesSecurityOptions