Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a developer of internal software in our company, I've gotten used to UAC in Win7, I prefer to run with in enabled so that our software works correctly with it enabled.

Sysadmins have recently pushed out GPO that turns it off every time we log-in. (So I turn it back on every time I log in.) I can imagine some people are annoyed by it and turn it off, but is that really a good company-wide decision? anyone annoyed by it (local admins) would already have permission to turn it of themselves.. right?

On the other hand we don't have to worry creating UAC friendly software if no workstations or servers have it enabled.

Is there a good reason for doing this? Other than reducing help-desk calls from users recently upgraded from XP?

I can't see the upside of this decision, help me understand.

share|improve this question

closed as off topic by RobM, Helvick, Iain, Antoine Benkemoun, Scott Pack Dec 23 '10 at 19:48

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

There's really only one place to get a definitive answer to this: from them. – RobM Dec 23 '10 at 17:52
I'll look into that, but Dev's and sysadmins here don't really talk to each other. When we do it's usually a pissing contest. If there are any good reasons they might do this, I'd like to be aware of them before going into battle. – DanO Dec 23 '10 at 17:58
It's a matter of usability versus security. I'm sure they have a valid reason or mandate to turn it off, but as Robert stated, the answer can only come from them. – joeqwerty Dec 23 '10 at 18:19
they could create a separate ou and put the developers in it should there be a business need for it. It isn't that hard to do. – aduljr Dec 24 '10 at 17:41

In our early testing of Windows 7, we were told the UAC dialogs were annoying/confusing. Management asked/told us to disable them as a result. So we turn off UAC for our domain workstations. All users log on as limited users and would be unable to elevate with their credentials anyway.

share|improve this answer
That actually sounds reasonable. Is there a way they could do it as one-time change so that devs and QA could turn it back on for certain machines if desired. – DanO Dec 23 '10 at 18:01
@DanO If your admins keep the dev/qa machines in their own OU, they could just unlink the GPO that applies the UAC settings. Else, you could ask your admins to use Group Policy Security Filtering to exclude the dev/qa machines. – jscott Dec 23 '10 at 18:21

I can see enforcing it be turned off if you have an existing enterprise app that just plain doesn't work well with it enabled.

share|improve this answer

I can't see a really good reason to disable it. In fact when I'm controlling the GPOs I actually enable it on all machines.

Disabling it wouldn't reduce XP help desk calls, as XP would ignore the UAC GPO settings.

share|improve this answer
It would reduce the calls from people who have recently been upgraded FROM XP to Vista or 7 though, who wouldn't have seen UAC before. – northirid Dec 23 '10 at 19:16

UAC is very useful in situations when your users don't have admin rights on computer so an admin can come up and easily fix something as he will be prompted for password by UAC. Withouht this it's a bit more time consuming.

I don't use UAC on my own computer and my servers as some software tends to freak out during installation with UAC turned on (like recent SP/Patches to Microsoft products).

Other then that all my users have UAC enabled and I wouldn't turn it off unless everyone does have admin rights on computer.

Also if you're developer keep on developing UAC aware applications... you never know when decision to turn it back on will be done :-)

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.