User Account Control (UAC)
User Account Control (UAC) is the Windows feature that asks for permission, or for an administrator's password, before a program can make changes that affect the whole computer. It keeps standard and admin work apart. Cyber Essentials Plus test case 5 passes only if a standard user is prompted for an additional login before an admin task runs.
- Term
- User Account Control
- Also known as
- UAC, User Account Control, Windows elevation prompt
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- A7.6
- Reviewed against
- Requirements v3.3
What does the term User Account Control mean in Cyber Essentials?
User Account Control (UAC) is the Windows feature that asks for permission, or for an administrator's password, before a program can make changes that affect the whole computer.
How does User Account Control apply to Cyber Essentials?
In plain terms
UAC works like a shop till that needs a supervisor's key for refunds. A member of staff can ring up sales all day, but the moment they try something bigger, the till stops and asks for the supervisor. On Windows, when a standard user tries to install software, a box appears asking for an administrator's username and password. Macs have a similar prompt.
What Cyber Essentials asks
Cyber Essentials does not name UAC. It requires separate accounts for admin work (A7.6) and no email or browsing on admin accounts (A7.7). UAC is the Windows mechanism that makes this practical: staff stay in a standard account and enter admin credentials only when a task needs them.
At Cyber Essentials Plus, test case 5 checks it on every sampled device. The pass rule is: "If the test results in the user being prompted for an additional login and the process does not run using the user account details, then award a Pass."
Common mistakes
- UAC switched off to stop the prompts.
- The everyday account is itself a local administrator, so Windows only shows a Yes or No box. No additional login is requested and the task runs with the user's own account, which fails test case 5.
See CE Plus test 5 and the Windows 11 setup guide. Related: standard user account, administrator account, LAPS.
Related terms
- Standard user accountA standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval.
- Administrator accountAn administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
- Windows LAPSLAPS is a Microsoft feature built into Windows that gives the local administrator account on every PC its own random password, changes it automatically and stores it securely.
- Account lockoutAccount lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying.
- Active Directory (AD)Active Directory is Microsoft's system, run on a Windows server in your own office or data centre, that holds the central list of staff logins, computers and permissions.
- Authenticator appAn authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve.
Frequently asked questions
User Account Control (UAC) is the Windows feature that asks for permission, or for an administrator's password, before a program can make changes that affect the whole computer.
In the 2026 Danzell question set, User Account Control comes up at A7.6. Read those questions against the definition above so your answers use the term the way the assessor will.
User Account Control relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.