How do I know when it's safe to allow programs that cause the User Account Control (UAC) notification to occur?

UAC kicks in because when running as administrator, you're not really running with full administrative privileges. There are certain things you cannot do, certain places you cannot store files or settings, and certain operations you cannot complete until or unless your access has been "elevated" to full administrative access.

That's all the UAC dialog is asking you for permission to do.

When you respond "yes", the program that's requesting it is granted true, full, administrative access to your machine. It can do anything - much like all programs could in Windows XP and prior versions if you were logged in as administrator.

The most obvious case where you want to say yes is when you actually are installing software. This is typically an operation that requires elevation, because the setup program will need to write into protected areas of your hard disk as well as the registry.

Another good example of when "yes" is appropriate is when you run software and it checks for updates to itself. This is much like an install, and requires that same elevated level of privilege to write things where in normal day-to-day operations software shouldn't be writing things.

At the other end of the spectrum a clear case for "no" is if you're surfing the web and the notification comes out of seemingly nowhere. That's a Big Red Flag that something sinister might be going on. It's also a clear case for the "if you're not sure, say no" default answer.

In reality, that "if you're not sure" is the crux of both the issue, and the problem.

If you're doing something that you expect might need special access to your machine - most typically adding or modifying the software installed on your machine - then it's reasonable to expect the UAC notification to happen, and to respond with a "Yes". The bottom line is that you're expecting it.

When it's not expected, it's time to look more closely.

As you can see from the message itself, the program that's requesting elevated privileges will be identified. This isn't 100% fool-proof, since of course malware can call itself whatever it likes, but it's a good sanity check. If you get the notification unexpectedly, you might look at the program requesting access, and say to yourself "oh yeah, that makes sense" and allow it.

Saying "no" is sometimes also a good diagnostic tool. If you get an unexpected notification and say "no", after which something you expected to work fails - in a way that might make sense to you as having needed those elevated privileges to do something - well, then you've got more data with which to make a decision. You might elect to re-run whatever made the request and say "yes" this time.

It's important to note that normal day-to-day operations shouldn't require elevation. Web surfing, emailing, writing documents or any of a number of normal activities just shouldn't result in a UAC notification. It's only when you're doing something that is about to make a system modification - like installing software - that UAC would normally pop up.

If you're seeing it at other times, and you weren't expecting it and you're not really sure why it's asking - say no. At least say no until you can determine more clearly why it's asking.

Because sometimes the "why" is something you don't want at all: malware.