How to Configure UAC with Microsoft Intune Settings Catalog

Navigate to the Microsoft Intune admin center and initiate the policy creation process. The Settings Catalog is the current recommended method for UAC configuration as of 2026.

Open your browser and navigate to https://intune.microsoft.com. Sign in with your Global Administrator or Intune Administrator credentials.

Once logged in, follow this navigation path:

1. Click Devices in the left navigation pane
2. Select Configuration
3. Click Create button
4. Choose New policy

In the policy creation wizard:

1. Platform: Select Windows 10 and later
2. Profile type: Choose Settings Catalog
3. Click Create

Set up the foundational information for your UAC policy. Proper naming and description help with policy management and troubleshooting.

On the Basics tab, configure the following:

• Name: Corporate UAC Policy 2026
• Description: Standardized UAC settings via Local Policies Security Options for enterprise security compliance
• Platform: Windows 10 and later (already selected)
• Profile type: Settings catalog (already selected)

Click Next to proceed to the Configuration settings tab.

Access the UAC settings through the Local Policies Security Options category. This is where Microsoft consolidated all UAC configuration options in 2025-2026.

On the Configuration settings tab:

1. Click the + Add settings button
2. In the search box, type: Local Policies Security Options
3. Select the Local Policies Security Options category from the results
4. Click Close to return to the settings list

You'll now see the Local Policies Security Options category added to your policy. Expand it to view all available UAC settings.

Configure the essential UAC settings that form the foundation of your enterprise security posture. These settings control how UAC behaves for both administrators and standard users.

Expand the Local Policies Security Options section and configure these critical settings:

1. Enable UAC Admin Approval Mode

Find and configure: User Account Control: Run all administrators in Admin Approval Mode

• Set to: Enabled
• Registry impact: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = 1

2. Administrator Elevation Behavior

Configure: User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

• Set to: Prompt for consent for non-Windows binaries (value 5)
• Registry impact: ConsentPromptBehaviorAdmin = 5

3. Standard User Elevation Behavior

Configure: User Account Control: Behavior of the elevation prompt for standard users

• Set to: Prompt for credentials (value 3)
• Registry impact: ConsentPromptBehaviorUser = 3

Set up additional UAC settings that enhance security by controlling secure desktop behavior and application installation detection.

4. Secure Desktop Protection

Configure: User Account Control: Switch to the secure desktop when prompting for elevation

• Set to: Enabled
• Registry impact: PromptOnSecureDesktop = 1
• Purpose: Prevents malware from interfering with UAC prompts

5. Application Installation Detection

Configure: User Account Control: Detect application installations and prompt for elevation

• Set to: Enabled
• Registry impact: EnableInstallerDetection = 1
• Purpose: Automatically detects installer packages and prompts for elevation

6. Virtualization Settings (Optional)

Configure: User Account Control: Virtualize file and registry write failures to per-user locations

• Set to: Enabled (recommended for legacy application compatibility)
• Registry impact: EnableVirtualization = 1

Deploy your UAC policy to specific device or user groups. Proper assignment ensures the policy reaches the intended devices while avoiding conflicts.

Click Next to reach the Assignments tab. Here you'll specify which devices or users receive this policy.

Assignment Options:

1. Click + Add groups under "Included groups"
2. Search for and select your target Entra ID security groups
3. Choose between:
   • Device groups: Apply to specific devices regardless of user
   • User groups: Apply to devices when specific users sign in

Recommended Assignment Strategy:

Include groups:
- "Corporate Devices - Windows"
- "IT Department - Devices"

Exclude groups:
- "Kiosk Devices"
- "Test Lab Devices"

Click Next to proceed to the review stage.

Complete the policy creation process and deploy it to your selected devices. This final step activates the UAC configuration across your enterprise.

On the Review + create tab, carefully review all your configurations:

• Verify the policy name and description
• Check that all UAC settings show the correct values
• Confirm the assigned groups are correct
• Review any scope tags if applicable

Once satisfied with the configuration, click Create to deploy the policy.

Post-Deployment Monitoring:

After creation, monitor the policy deployment:

1. Navigate to Devices > Configuration
2. Find your "Corporate UAC Policy 2026" in the list
3. Click on the policy name to view deployment status
4. Check the Device and user check-in status section

Confirm that the UAC policy has been successfully applied to your target devices by checking registry values and UAC behavior.

PowerShell Verification Script:

Run this PowerShell command as an administrator on a target device:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" |
Select ConsentPromptBehaviorAdmin, ConsentPromptBehaviorUser, 
       EnableLUA, PromptOnSecureDesktop, EnableInstallerDetection |
Format-Table -AutoSize

Expected Output for Enterprise Configuration:

ConsentPromptBehaviorAdmin : 5
ConsentPromptBehaviorUser  : 3  
EnableLUA                 : 1
PromptOnSecureDesktop     : 1
EnableInstallerDetection  : 1

Alternative Verification Methods:

1. Control Panel Check: Navigate to Control Panel > User Accounts > Change User Account Control settings. The slider should reflect your configured behavior.
2. Test UAC Prompt: Try running an application as administrator to verify the prompt behavior matches your policy.
3. Event Logs: Check Windows Logs > Security for Event ID 4648 (successful logon with explicit credentials).

Address common problems that may prevent UAC policies from applying correctly. These troubleshooting steps resolve the most frequent deployment issues.

Issue 1: Policy Not Applying

Symptoms: Registry values don't match policy settings

Solution: Check for Group Policy conflicts

# Check for conflicting GPO settings
gpresult /r /scope:computer

# Remove conflicting registry entries if safe to do so
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Policies\System" -Name "*" -Force

Issue 2: Access Denied Errors

Symptoms: Devices show "Access Denied" in Intune reporting

Solution: Re-establish device trust relationship

# Run as administrator
dsregcmd /leave
# Restart device, then rejoin to Azure AD
dsregcmd /join

Issue 3: UAC Slider Stuck

Symptoms: Control Panel slider doesn't reflect policy changes

Solution: Clear cached user settings

# Clear user-specific UAC cache
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "*" -ErrorAction SilentlyContinue

# Force policy refresh
gpupdate /force

Issue 4: Delayed Policy Application

Solution: Force immediate device sync

# Force Intune sync
Get-ScheduledTask | Where-Object {$_.TaskName -eq "PushLaunch"} | Start-ScheduledTask

# Alternative: Manual sync through Settings
# Settings > Accounts > Access work or school > Info > Sync