User Account Control (UAC) is a Windows security feature that runs programs with standard user rights by default and asks for confirmation or credentials before an action requires administrator privileges.
How UAC works
UAC was introduced in Windows Vista in 2007 to reduce the damage caused by users who always worked as administrators. When an administrator logs in, Windows creates two access tokens: a filtered standard-user token used for everyday programs, and a full administrator token. When a program needs elevated rights – installing software, changing system settings – UAC shows a prompt:
- a consent prompt (“Yes/No”) for members of the Administrators group;
- a credential prompt for standard users, who must enter an admin password.
The prompt usually appears on the “secure desktop”, which other programs cannot interact with. UAC also uses integrity levels and file and registry virtualisation for legacy applications.
Why UAC matters
UAC supports the principle of least privilege: malware launched by a user does not automatically get full control of the system. Microsoft, however, does not consider UAC a security boundary, and the default setting lets some trusted Windows binaries elevate silently. Attackers exploit this with UAC bypass techniques (MITRE ATT&CK T1548.002): for example, hijacking registry keys in the Windows Registry that auto-elevating programs such as fodhelper.exe or eventvwr.exe read, so that the attacker’s command runs with high integrity without any prompt. UAC bypasses are a common step in privilege escalation by commodity malware and ransomware.
Best practices
- Keep UAC enabled and set it to “Always notify” on sensitive systems.
- Give users standard accounts and use separate admin accounts.
- Monitor for changes to auto-elevation-related registry keys and unusual child processes of auto-elevating binaries.
