1

I would like to have an administrator account just for UAC prompts. Is it possible to disable the desktop feature? So that I just can use that account for UAC prompts only and not actually login to see the desktop or something?

I tried changing the gpedit.msc option Deny log on locally. But after that I couldn't login anymore, even at the UAC prompts.

Is there any other way?

1
  • No, there isn't.
    – harrymc
    Commented Mar 16, 2019 at 10:02

1 Answer 1

1

The configuration you're asking for is not possible because:

  1. Only an administrator can complete a UAC prompt.
  2. An administrator user can change any setting in Windows.
  3. Therefore, an administrator can revert a deny logon setting.

As a result, there is no configuration available in Windows that can effectively create the result you're asking for. As shown above, even if you could put one in place, the administrator could defeat it.

Additionally, the UAC architecture requires that the user account used to elevate processes not be denied the log on locally user right.

5
  • Despite this, would it meet your purposes to simply hide the administrator account from the login screen? If so, I can edit my answer to explain how to do this. @Phil Commented Mar 16, 2019 at 14:46
  • Though again, the admin could defeat this setting too. Commented Mar 16, 2019 at 15:01
  • 1
    A user not being able to log into Windows, but sill authenticate, would not increase security on your system (even if it was possible it would serve no purpose).
    – Ramhound
    Commented Mar 16, 2019 at 15:46
  • @Ramhound I certainly don't want to improve security with this. It was just asking because I was intereseted.
    – phrogg
    Commented Mar 17, 2019 at 15:21
  • You're welcome. Please mark this answer accepted if it answered your question. Commented Mar 17, 2019 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .