Configuring UAC Secure Desktop settings for specific applications

Computer ConfigurationWindows SettingsLocal PoliciesSecurity Options

User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop.





This security setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts being used by a standard user.

If you enable this setting, UIA programs including Windows Remote Assistance can automatically disable the secure desktop for elevation prompts. Unless you have also disabled elevation prompts, the prompts will appear on the interactive user’s desktop instead of the secure desktop.

If you disable or do not configure this setting, the secure desktop can only be disabled by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" setting.

UIA programs are designed to interact with Windows and application programs on behalf of a user. This setting allows UIA programs to bypass the secure desktop to increase usability in certain cases, but allowing elevation requests to appear on the regular interactive desktop instead of the secure desktop increases your security risk.

Since UIA programs must be able to respond to prompts regarding security issues, such as the UAC elevation prompt, UIA programs must be highly trusted. In order to be considered trusted, a UIA program must be digitally signed. By default, UIA programs can be run only from the following protected paths:
                ..Program Files (and subfolders)
                ..Program Files (x86) (and subfolders, in 64-bit versions of Windows only)

The requirement to be in a protected path can be disabled by the "User Account Control: Only elevate UIAccess applications that are installed in secure locations" setting.

While this setting applies to any UIA program, it will be used primarily in certain Windows Remote Assistance scenarios. The Windows Remote Assistance program in Windows Vista is a UIA program.

If a user requests remote assistance from an administrator and the remote assistance session is established, any elevation prompts appear on the interactive user’s secure desktop and the administrator’s remote session is paused. To avoid pausing the remote administrator’s session during elevation requests, ,the user may select the "Allow IT Expert to respond to User Account Control prompts" check box when setting up the remote assistance session. However, selecting this check box itself requires  that the interactive user respond to an elevation prompt on the secure desktop. If the interactive user is a standard user, the user does not have the required credentials to allow elevation.

If you enable this setting, ("User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop”), , requests for elevation are automatically sent to the interactive desktop (not the secure desktop) and also appear on the remote administrator’s view of the desktop during a Windows Remote Assistance session, and the remote administrator is able to provide the appropriate credentials for elevation.

This setting does not change the behavior of the UAC elevation prompt for administrators.

If you plan to enable this setting, you should also review the effect of the "User Account Control: Behavior of the elevation prompt for standard users" setting. If it is configured as "Automatically deny elevation requests" elevation requests will not be presented to the user.



5 thoughts on “Configuring UAC Secure Desktop settings for specific applications”

  1. Dell inspiron 8600 battery Dell inspiron b120 battery Dell inspiron b130 battery Dell kg046 battery Dell latitude d410 battery Dell latitude d420 battery Dell latitude d430 battery Dell latitude d610 battery Dell latitude d810 battery Dell pg043 battery Dell precision m70 battery Dell vostro 1310 battery Dell vostro 1320 battery Dell vostro 1510 battery Dell vostro 1520 battery Dell vostro 2510 battery Hp f2024 battery Hp f2024a battery Hp f2024b battery Hp f2111 battery Hp hstnn-db63 battery Hp hstnn-db64 battery Hp hstnn-ob71 battery Hp hstnn-xb70 battery Hp nc4200 battery Hp nc4400 battery Hp pavilion dv2133 battery Hp pavilion dv3000 battery Hp pavilion dv3500 battery Hp pavilion n5130 battery Hp pavilion n5140 battery Hp pavilion n5150 battery Hp pavilion n5170 battery Hp pavilion n5190 battery Hp pavilion n5200 battery Hp pavilion tx1000 battery Hp pavilion tx1100 battery Hp pavilion tx2000 battery Hp tc4200 battery Hp tc4400 battery Ibm thinkpad r50 battery Ibm thinkpad t20 battery Ibm thinkpad t21 battery Ibm thinkpad t22 battery Ibm thinkpad t23 battery Ibm thinkpad t42 battery

  2. Ibm thinkpad t43 battery Ibm thinkpad x20 battery Ibm thinkpad x200 battery Ibm thinkpad x21 battery Ibm thinkpad x22 battery Ibm thinkpad x23 battery Ibm thinkpad X40 battery Ibm thinkpad x60 battery Ibm thinkpad z60t battery Msi bty-s11 battery Msi bty-s12 battery Msi wind u100 battery Msi wind u90 battery Sony vgp-bps5 battery Sony vgp-bps5a battery Toshiba pa3123u-1brs battery Toshiba pa3178u-1bas battery Toshiba pa3178u-1brs battery Toshiba pa3211u-1bas battery Toshiba pa3211u-1brs battery Toshiba pa3479u-1brs battery Toshiba pa3480u-1brs battery Toshiba pa3591u-1bas battery Toshiba pa3634u-1bas battery Toshiba pa3635u-1bam battery Toshiba pa3635u-1brm battery Toshiba pa3638u-1bap battery acer batsqu410 battery acer sq-1100 battery acer sq-2100 battery acer squ-202 battery acer squ-405 battery acer squ-406 battery acer squ-410 battery mitac bp-8089 battery mitac bp-8089p battery mitac bp-8389 battery sony vgp-bpl9 battery sony vgp-bps10 battery sony vgp-bps8 battery sony vgp-bps8a battery sony vgp-bps9 battery toshiba pa3369u-1bas battery toshiba pa3369u-1brs battery

Leave a Comment

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s