User Account Control Settings
The UAC switches, which say whether UAC is on and how admins are prompted.
Use it to tell whether UAC was weakened or switched off, including the remote local-admin filter.
- SOFTWARE
- Defence Evasion
What It Is
User Account Control (UAC) is the Windows feature that asks the user to approve a change that needs administrator rights. With UAC on, an administrator's programs run with a standard user token, meaning ordinary rights, until the user approves a prompt to use their full administrator token. This key, in the SOFTWARE hive, holds the UAC settings that Group Policy and the Local Security Policy console (secpol.msc) manage. EnableLUA turns on Admin Approval Mode for every administrator, and ConsentPromptBehaviorAdmin decides how administrators are prompted.
What It Proves
EnableLUA set to 0 switches UAC off, giving admin tokens with no prompt. ConsentPromptBehaviorAdmin at 0 elevates silently, and LocalAccountTokenFilterPolicy at 1 gives local admins full tokens over the network.
What It Does Not Prove
These are configuration values, not proof of elevation. EnableLUA changes take effect only after a reboot, and a few of these are set deliberately by administrators.
Where It Lives
User Account Control Settings lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| UAC is set off, which takes effect at the next restart. Admins then get full tokens and no prompt. Restore it to 1, reboot, and find who changed it. |
| Admins elevate silently with no consent prompt, where the default is 5. Elevated starts show in event 4688 only if process creation auditing is on. |
| Local admin accounts get full tokens over the network, easing lateral movement. Set it back to 0 and check type 3 logons by local accounts in event 4624 in the Security log. |
How to Read It
Read EnableLUA, ConsentPromptBehaviorAdmin, PromptOnSecureDesktop and LocalAccountTokenFilterPolicy under Policies\System. Secure values are EnableLUA 1, ConsentPromptBehaviorAdmin 5 or 2, PromptOnSecureDesktop 1 and LocalAccountTokenFilterPolicy 0. To put it right, restore those values, reboot if EnableLUA changed, and review who made the change.
- When Windows Writes It
- It is written when Group Policy or an attacker with admin rights sets a value. EnableLUA needs a reboot to take effect.
- Which Windows Versions
- Windows Vista to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (uac)
Hunt It
Defender records writes to these policy values. A hit shows the setting, not an elevation. EnableLUA 0 takes effect only after a reboot, and it and LocalAccountTokenFilterPolicy 1 are the hits to treat as urgent.
// UAC switches changedDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what User Account Control Settings shows.
- Elevated Process Starts, Security Event 4688Not in the RegistryShows programs that started elevated, if process creation auditing is on.
- Remote Logons by Local Accounts, Security Event 4624Not in the RegistryShows network logons by local accounts, the ones LocalAccountTokenFilterPolicy lets act with full admin rights.
Sources
The facts on this page come from these public pages, which say more on each point.
- Microsoft Learn: UAC settings and configuration (opens in a new tab)
- Microsoft Learn: UAC and remote restrictions (opens in a new tab)
- MITRE ATT&CK T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control (opens in a new tab)
- Microsoft Learn: User Account Control overview (opens in a new tab)