Modifying User Account Control And Admin Approval Mode - Microsoft Windows Vista Manual

Modifying User Account Control and Admin Approval Mode

Administrators can change the way User Account Control and Admin Approval Mode work in
several different ways. They can:
Disable running all users as standard users.
Disable prompting for credentials to install applications.
Change the elevation prompt behavior.
Each of these tasks is configured through Group Policy and can be configured on a per-com-
puter basis through Local Group Policy or on a per-domain, per-site, or per-organizational-unit
basis through Active Directory Group Policy. The sections that follow focus on configuring
the related settings by using Local Group Policy.
Disabling Admin Approval Mode
By default, Windows Vista uses Admin Approval Mode to run programs for all users, includ-
ing administrators, as standard users. This approach serves to better safeguard the computer
from malicious software by ensuring that any time programs need administrator privileges,
they must prompt the user for approval. To bypass the safety and security settings, you can
modify this behavior so that administrators run programs as administrators and standard
users run programs as standard users.
You can use the following procedure to disable Admin Approval Mode:
1. Log on to the computer as a member of the local Administrators group.
2. Click Start, point to All Programs, Accessories, and then click Run.
3. Type secpol.msc in the Open text box, and then click OK.
4. In the console tree, under Security Settings, expand Local Policies, and then select Secu-
rity Options.
5. Double-click User Account Control: Run All Administrators In Admin Approval Mode.
6. Click Disabled, as shown in Figure 9-3, and then click OK.
Figure 9-3 Disabling Admin Approval Mode
Chapter 9: Protecting User Accounts and Using Parental Controls
137