Helping people with computers... one answer at a time.

User Account Control is a security feature of Windows 7 that's intended to protect you from malware making unauthorized changes. I'll look at configuring it.

I am the ONLY person using an Acer notebook with Windows 7 and have full administrator authorization, obviously. Nevertheless, there are many things that I cannot do (like unmark 'Read Only' from some folders or move/copy files into them. I get a message saying, 'You need full administration rights to do this'). If I click Continue, nothing happens. So the question is: how do I TOTALLY disable ANY limitations on the operation of this computer and in Windows 7?

As I discussed in an earlier article, Why does my computer say I need to be administrator, when I am?, even when you're logged in using an account that has administrative privileges, you're not really running as administrator. You'll still need to confirm administrative operations - those operations requiring what's called "elevation" to true administrator.

User Account Control, or UAC, is an important and, in my mind, very valuable security feature. It prevents malicious software that you might accidentally run from having administrative access and wreaking all sorts of havoc.

I don't recommend turning it off. Not at all.

However, for those that insist, I'll show you how.

Getting to the UAC options

Open Control Panel and click on System and Security:

Control Panel, System and Security link

Click on Change User Account Control Settings:

Control Panel, Change UAC settings link

This should open the User Account Control Settings dialog:

User Account Control Settings

This is where you'll make your change.

UAC Options

Windows 7 introduced the ability to adjust UAC to different levels.

  • Never notify: Click and drag the UAC control to the bottom to effectively turn off UAC. You won't be notified, no matter what happens. (This is roughly equivalent to Windows XP's operation when logged in as administrator.)

  • Notify me only when programs try to make changes to my computer (do not dim my desktop): While it seems like the visual "do not dim" is the primary point here, it's not really. Dimming the display is a side effect of Windows taking additional steps to prevent malware from automatically answering the UAC prompt on your behalf. With this setting, sufficiently sophisticated malware has the opportunity to bypass the UAC prompt.

  • Notify me only when programs try to make changes to my computer: As indicated, this is the default setting. When the UAC prompt is presented, Windows switches to what's called a "secure desktop" - the dim desktop that prevents certain types of malicious interactions.

  • Always notify me when: This setting notifies not only when programs attempt to make changes, but when you make changes as well. Much like the item above, it's an additional step that prevents malware from "pretending to type" as if it were you. For example, malware might automatically send fake keystrokes that fired up control panel and turned off your firewall. Without this warning, you'd never know or have a chance to disallow the setting change.

Microsoft has a more detailed What are User Account Control settings? article online if you'd like more.

What should you do?

UAC Notification in Windows 7

If you're a half-way knowledgeable user and don't run around visiting the darker or more questionable side of the internet or download lots of potentially questionable software, the default setting is appropriate. It's what I run and I don't find it objectionable at all. In fact, it serves as a fine reminder that something that modifies my system is about to happen.

I'd recommend the highest level setting for those who are less experienced or don't have a clear sense of what may or may not be safe.

Turning UAC off is, of course, an option. As I said above, it's roughly equivalent to the way that Windows XP ran for years. Of course, XP was (and remains) vulnerable to everything that UAC in Windows Vista and Windows 7 protects you against.

So as you can imagine, I no longer consider turning UAC off completely a wise decision, except perhaps in some extreme or problematic cases.

Article C4835 - June 3, 2011 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

8 Comments
Kerry
June 7, 2011 9:50 AM

I always run UAC at the default level. There have been times where I want to install software, but the lack of a "run as administrator" has prevented this. What to do?

Open a Windows Command Processor window "run as administrator"

Enter: net user administrator /active:yes

Reboot, and now administrator will be visible for login; login & install away

When finished, log out of admin, log into your own account, Open a Windows Command Processor window "run as administrator"

Enter: net user administrator /active:no

Reboot & admin will no longer be visible.

I would say this is for advanced users only. Care to comment further?

Snert
June 7, 2011 10:10 AM

I don't mind the alerts that UAC tosses my way. I know that things are happening that should be happening. If you initiated the software and want the changes, a click or two and you're on your merry way.
A buddy keeps his car alarm turned on even if the car's in the garage., JIC.

chet
June 7, 2011 12:06 PM

This is re the comment above.
"Open a Windows Command Processor window "run as administrator"
How do you open the windows command processor window?

Usually it's in Start->All Programs->Accessories
Leo
10-Jun-2011

Mark J
June 7, 2011 12:23 PM

@Chet

In XP click the "Start button" then select "Programs" then Accessories" then "Command prompt" this will open the command processor window.

In Windows 7 and Vista. Click the "Start button" and type "cmd.exe" into the search line. One or more choices will appear above it. Right click on the one that says "cmd.exe" with a black screen icon to the left of it. Select "Run as administrator" from the pull own menu.

Bruce
June 7, 2011 4:37 PM

This doesn't address the limitations in Explorer to open 'protected' folders and many other security (real or imagined) issues. Try opening the Document and Settings folder... Nope, can't do it... I, too, am frustrated by these limitations over MY computer.

Mark J
June 7, 2011 11:34 PM

@Bruce
In windows 7 the folders previously accessed through Documents and Settings are now available through the c:\users folder.

JustInspired
June 7, 2011 11:45 PM

@Bruce You should be able to browse the Documents and Settings folder in XP but not Vista or 7.
Vista and Windows 7 now use the 'Users' folder and 'Documents and Settings' is just a 'marker' for older programs that expect to find it on your system. See here for more info: http://answers.microsoft.com/en-us/windows/forum/windows_vista-security/access-denied-to-the-my-documents-and-settings/915eecc8-6a07-4d6a-8ca5-468ee51e9484

Mike
June 8, 2011 8:43 AM

I think I mentioned somewhere that I've been using computers since DOS-1A, so I'm no novice (or dunce). UAC in Vista was SO annoying that I turned it off. THAT was when I became a dunce. A drive-by on some site (don't know which one) downloaded malware onto my computer and I'd disabled the only means to stop it. My NAT router, anti-malware monitor, anti-virus monitor, and software firewall all allowed it through.

After spending an entire day tracking down the offending malware and working to remove it, I'd learned to suffer the annoyance of UAC. Fortunately, in Win7 it's not so annoying, but still effective in preventing drive-by attacks.

UAC in Windows is very much like the protection in MAC or Linux that helps them avoid so much of the malware that is prevalent in Windows.

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.