AutoElevate relies on Windows User Account Control (UAC) to detect and process elevation events. If UAC is disabled or Windows policies substantially change the normal elevation prompt, AutoElevate may not receive the information required to process the event.

This article explains:

• Recommended UAC settings for AutoElevate
• How UAC levels appear in the Admin Portal
• How AutoElevate changes UAC settings
• Windows policies that can interfere with elevations
• Compatibility considerations for Windows Hello and Windows Passwordless Experience

Recommended UAC Configuration

For most environments, CyberFOX recommends the following configuration:

• UAC Status: On
• Secure Desktop: Enabled
• Administrator Level: Level 3
• Standard User Level: Level 4

This appears in the AutoElevate Admin Portal as:

• UAC Status: On (Dimmed)
• UAC Admin Level: Level 3
• UAC User Level: Level 4

This configuration corresponds to the following Windows registry values:

EnableLUA = 1
PromptOnSecureDesktop = 1
ConsentPromptBehaviorAdmin = 5
ConsentPromptBehaviorUser = 1

AutoElevate onboarding documentation also identifies On (Dimmed), Level 3 for administrators and Level 4 for users as the recommended configuration.

Important: AutoElevate requires UAC to be enabled and configured to display elevation prompts. When UAC is disabled or set too low to generate a prompt, AutoElevate has no UAC event to detect or process.

 

Understanding UAC Levels

AutoElevate reads the computer’s Windows UAC registry values and reports them in the Computers grid of the Admin Portal.

The reported UAC level corresponds to the slider position in Windows User Account Control Settings.

Administrator Levels

Standard User Levels

UAC Values in the Admin Portal

The UAC Status, UAC Admin Level, and UAC User Level columns are calculated from several Windows registry values.

These registry values are located under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Changing UAC Settings from AutoElevate

UAC settings can be changed from the Computers screen in the Admin Portal.

1. Open Computers.
2. Select the affected computer.
3. Select Actions.
4. Choose the required UAC Settings action.
5. Restart the computer if the UAC status was changed between On and Off.

The available actions apply the following configurations:

Changing UAC between On and Off requires a restart before Windows and AutoElevate will reflect the new behavior correctly.

Elevation Behavior by AutoElevate Mode

AutoElevate’s response to a UAC event also depends on the computer’s Elevation Mode.

Live Mode

In Live Mode, AutoElevate can display its elevation dialog and allow the user to request access when no matching rule exists.

Policy Mode

In Policy Mode, events without a matching rule display the standard Windows UAC prompt. The AutoElevate request-access dialog is a Live Mode behavior and is not displayed for unmatched events in Policy Mode. 

If a customer reports seeing only the standard Windows UAC prompt, verify both:

• The computer’s UAC configuration
• The computer’s AutoElevate Elevation Mode

Windows Policies That Can Affect AutoElevate

Windows security policies can change whether UAC appears, what information it displays, and which authentication methods are available. These changes may prevent AutoElevate from detecting or completing an elevation.

Behavior of the Elevation Prompt for Administrators

Location:

Computer Configuration
└ Windows Settings
  └ Security Settings
    └ Local Policies
       └ Security Options
         └ User Account Control:
           Behavior of the elevation prompt for administrators
           in Admin Approval Mode

Common options include:

• Prompt for consent
• Prompt for credentials
• Elevate without prompting

Avoid Elevate without prompting when AutoElevate must process elevation events. If Windows does not display an elevation prompt, AutoElevate may have no event to intercept.

For environments where administrators receive only a Yes or No consent prompt, Prompt for credentials forces Windows to display a credential-based elevation prompt.

Behavior of the Elevation Prompt for Standard Users

Location:

Computer Configuration
└ Windows Settings
  └ Security Settings
    └ Local Policies
      └ Security Options
        └ User Account Control:
          Behavior of the elevation prompt for standard users

Options include:

• Prompt for credentials
• Automatically deny elevation requests

If this policy is set to automatically deny requests, Windows can display the message:

This app has been blocked by your system administrator.

For standard-user elevations, ConsentPromptBehaviorUser should not be set to 0. 

Switch to the Secure Desktop When Prompting for Elevation

This policy controls whether the UAC prompt appears on the isolated Secure Desktop.

CyberFOX’s recommended On (Dimmed) configuration enables the Secure Desktop:

PromptOnSecureDesktop = 1

Run All Administrators in Admin Approval Mode

This policy controls whether administrator accounts use Admin Approval Mode and receive UAC prompts. Disabling this behavior can allow administrators to perform actions without generating the expected UAC prompt.

Only Elevate Executables That Are Signed and Validated

When enabled, Windows permits only signed and validated executables to elevate. Unsigned applications may be blocked before AutoElevate can process them.

Detect Application Installations and Prompt for Elevation

When enabled, Windows attempts to identify application installers and display an elevation prompt. Disabling the policy can change whether some installers generate a UAC event.

Windows Hello and Windows Passwordless Experience

Windows Hello and Windows Passwordless Experience are related, but they are not the same configuration.

Windows Hello provides authentication methods such as:

• PIN
• Facial recognition
• Fingerprint authentication
• FIDO2 security keys

Windows Passwordless Experience is a Windows 11 policy that removes the password option from certain authentication scenarios for eligible Microsoft Entra users who sign in with Windows Hello or a FIDO2 security key.

When enabled, users are not prompted to enter a password during supported in-session authentication scenarios, including UAC elevation. Microsoft states that the feature applies to Microsoft Entra-joined devices and does not apply to Microsoft Entra hybrid-joined or Active Directory domain-joined devices. 

Impact on AutoElevate

AutoElevate user elevation currently depends on Windows credential and UAC workflows that may require the user’s password.

Windows Passwordless Experience can:

• Hide password-based authentication options
• Change the available fields in a UAC prompt
• Prevent users from supplying the password expected by the elevation workflow
• Cause user elevation requests to fail or not complete as expected

Internal investigation indicates that the primary compatibility issue is the passwordless workflow, not simply the use of Windows Hello for workstation sign-in. 

Recommended Configuration

If a user elevation fails in an environment using Windows Hello:

1. Determine whether Enable Passwordless Experience is enabled.
2. Confirm that the standard Windows credential prompt is available during UAC elevation.
3. Disable Enable Passwordless Experience on affected computers if password-based UAC authentication is required.
4. Test the elevation again.

Windows Hello may remain enabled for computer sign-in. The setting being disabled is Windows Passwordless Experience, not necessarily Windows Hello itself.

The policy is available in Intune under:

Devices
└ Configuration
  └ Create policy
    └ Settings catalog
      └ Authentication
        └ Enable Passwordless Experience

Set the policy to Disabled or remove its assignment from affected devices.

Troubleshooting AutoElevate UAC Events

No AutoElevate Event Appears

Verify the following:

1. UAC is enabled.
2. The computer has been restarted after changing UAC from Off to On.
3. The applicable Windows policy generates a prompt rather than automatically approving or denying the elevation.
4. ConsentPromptBehaviorUser is not set to 0 for standard users.
5. Windows Passwordless Experience is not altering the required UAC workflow.
6. The computer is in the expected AutoElevate Elevation Mode.

The User Sees Only a Yes or No Prompt

Windows is prompting the administrator for consent rather than credentials.

If credentials are required, configure:

User Account Control:
Behavior of the elevation prompt for administrators
in Admin Approval Mode

Set the policy to:

Prompt for credentials

The User Sees “This App Has Been Blocked by Your System Administrator”

Check:

ConsentPromptBehaviorUser

A value of 0 automatically denies standard-user elevation requests. Review the applicable local policy, domain policy, Intune policy, or registry configuration before changing the value.

Elevations Fail After Enabling Passwordless Sign-In

Confirm whether the environment enabled the separate Windows Passwordless Experience policy. A Windows Hello PIN or biometric sign-in does not automatically prove that this policy is enabled. Check the assigned Windows or Intune configuration directly. If the policy is enabled, temporarily disable it for the affected device and test the elevation again.

The Portal Shows a Pending UAC Change

Restart the computer when changing UAC between On and Off. If the pending status remains after the restart:

1. Confirm that the AutoElevate agent service is running.
2. Check the current registry values under the Windows UAC policy path.
3. Review whether domain policy or device-management policy is reapplying a different setting.
4. Contact CyberFOX Support if the portal and computer continue to report different values.

Frequently Asked Questions

Does AutoElevate require UAC?

Yes. AutoElevate processes Windows UAC events. If UAC is disabled or configured not to generate a prompt, AutoElevate may have no elevation event to process. 

Does AutoElevate support Windows Hello?

The use of Windows Hello for workstation sign-in is not the same as enabling Windows Passwordless Experience.

Compatibility issues can occur when passwordless policies remove or alter the credential-based UAC workflow required for AutoElevate user elevation. Verify the passwordless policy configuration before disabling Windows Hello entirely.

Should administrators use Prompt for Consent or Prompt for Credentials?

The correct setting depends on the environment’s elevation workflow. CyberFOX’s standard recommended configuration uses Administrator Level 3, which corresponds to the standard consent prompt on the Secure Desktop.

Use Prompt for credentials when the workflow specifically requires a credential-based UAC prompt.

Why are no AutoElevate prompts displayed in Policy Mode?

Policy Mode displays the standard Windows UAC prompt when no matching elevation rule exists. Request-access functionality is available through the richer AutoElevate dialog in Live Mode.

Computer Configuration
└ Windows Settings
  └ Security Settings
    └ Local Policies
      └ Security Options
        └ User Account Control:
          Behavior of the elevation prompt for administrators in Admin Approval Mode

Prompt for credentials

Computer Configuration
└ Windows Settings
  └ Security Settings
    └ Local Policies
      └ Security Options
        └ User Account Control:
          Behavior of the elevation prompt for standard users

This app has been blocked by your system administrator

Computer Configuration
└ Windows Settings
  └ Security Settings
    └ Local Policies
      └ Security Options
        └ User Account Control:
          Run all administrators in Admin Approval Mode

Computer Configuration
└ Windows Settings
  └ Security Settings
    └ Local Policies
      └ Security Options
        └ User Account Control:
          Switch to the secure desktop when prompting for elevation

Intune Admin Center
└ Devices
  └ Configuration Profiles
    └ Create Profile
      └ Settings Catalog
        └ Authentication
          └ Enable Passwordless Experience

Computer Configuration
└ Windows Settings
  └ Security Settings
    └ Local Policies
      └ Security Options
        └ User Account Control:
          Run all administrators in Admin Approval Mode

Computer Configuration
└ Windows Settings
  └ Security Settings
    └ Local Policies
      └ Security Options
        └ User Account Control:
          Switch to the secure desktop when prompting for elevation

Computer Configuration
└ Windows Settings
  └ Security Settings
    └ Local Policies
      └ Security Options
        └ User Account Control:
          Only elevate executables that are signed and validated

Computer Configuration
└ Windows Settings
  └ Security Settings
    └ Local Policies
      └ Security Options
        └ User Account Control:
          Virtualize file and registry write failures to per-user locations

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Additional Resources

• Microsoft: Configure Windows Passwordless Experience with Intune
• Turn On and Control the UAC
• Creating Elevation Rules From UAC Events