Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Someone or something recently disabled UAC on a critical server and it is now asking for a reboot (which can not happen). Is there an event in the logs that will tell me which account disabled this? And can I re-enable it without rebooting to get rid of the 'reboot' prompt?


share|improve this question
Not an answer but... Are you sure about granting admin privileges to lots of people? Unexperienced admins can cause a lot more damage on critical (you said that) servers – usr-local-ΕΨΗΕΛΩΝ Nov 27 '12 at 11:57
That's a good point. I shouldn't have said critical, as it's not production but it is a shared terminal server in the production environment. By critical I meant, critical that it not be rebooted since it's always in use by many other developers. – eth0 Nov 27 '12 at 20:01

Privilege Elevation yields a logon event, so look after the last occurrences of Event ID 4648 (interactive logon) and 4624 (successful logon attempt) in the Security Log.

Otherwise, change the UAC policy back and check what events are generated in the event log - then search for similar events

Update: If you have large volumes of event log entries to search through, have a go with EventCombMT and search for the above mentioned events. It is a bit old school, but very useful for gathering and sorting event log entries on one or more Windows machines

share|improve this answer
+1 Also, System Log: Event 104 - XXX log file was cleared in case they had half a brain. – Chris S Nov 27 '12 at 0:48
And Security Log event id 1102 – Mathias R. Jessen Nov 27 '12 at 0:49
The problem is, I have about a dozen users RDP's into this box at once. So I also have a couple dozen security events per minute, it looks like. Even if I knew what time this took place, it would be quite difficult to figure out. – eth0 Nov 27 '12 at 1:47
So, basically everybody that is logged into this machine currently match the event ID's I found, which are triggered in the Security event log by changing the UAC; found by testing with my own account. I probably should have mentioned this is a terminal server. Does this make it impossible to find the information I am looking for? – eth0 Nov 27 '12 at 4:27
When you say "disabled UAC", are you referring to changing the settings and policies guarding UAC, or per-user UAC options? – Mathias R. Jessen Nov 27 '12 at 12:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.