The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →To keep Windows UAC prompts visible during remote assistance or other interactive workflows, create an Intune Settings catalog policy and configure Local Policies Security Options > User Account Control: Switch to the secure desktop when prompting for elevation. Set it to Disabled. This changes where the prompt appears; it does not turn off UAC or grant the requested elevation.
Microsoft documents Enabled as the default. With the setting disabled, elevation requests go to the signed-in user’s interactive desktop, where they can be seen by normal desktop applications. That can remove interruptions for support staff, but it also removes the secure desktop’s isolation and increases the opportunity for a malicious application to imitate a prompt. Treat the change as an environment-specific risk decision, not a universal best practice.
As an Amazon Associate I earn from qualifying purchases.
What the secure-desktop switch actually changes
Windows uses two desktop contexts when displaying an elevation request. The secure desktop is isolated from ordinary applications. The interactive desktop is the desktop the signed-in user is already using. The Intune policy controls the destination of the UAC prompt, not the authorization decision behind it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Enabled: the documented default
When User Account Control: Switch to the secure desktop when prompting for elevation is enabled, Windows displays the elevation prompt on the secure desktop. The user may see the screen dim or otherwise switch context while the consent or credential dialog is active. This is the default state documented for the policy.
#1 Best Overall
- Instantly productive. Simpler, more intuitive UI and effortless navigation. New features like snap layouts help you manage multiple tasks with ease.
- Smarter collaboration. Have effective online meetings. Share content and mute/unmute right from the taskbar (1) Stay focused with intelligent noise cancelling and background blur.(2)
- Reassuringly consistent. Have confidence that your applications will work. Familiar deployment and update tools. Accelerate adoption with expanded deployment policies.
- Powerful security. Safeguard data and access anywhere with hardware-based isolation, encryption, and malware protection built in.
Disabled: route the prompt to the interactive desktop
When the policy is disabled, Microsoft defines the result this way: Disabled: All elevation requests go to the interactive user’s desktop. Prompt behavior policy settings for administrators and standard users are used.
In practical terms, a support technician and the signed-in user can keep working in the ordinary desktop context while the request is displayed there.
The change is about prompt location. It does not automatically approve a request, convert a standard user into an administrator, remove credential requirements, or alter which executable requested elevation.
Comparison of the two states
| Policy state | Prompt location | Administrator and standard-user behavior | Remote or interactive workflow effect | Security consideration |
|---|---|---|---|---|
| Enabled (default) | Secure desktop | Controlled by the separate administrator and standard-user UAC prompt policies | The desktop context can interrupt a remote-support session or other user interaction | Provides separation between the elevation prompt and ordinary desktop applications |
| Disabled | Interactive user’s desktop | Still controlled by the separate administrator and standard-user UAC prompt policies | Prompt remains visible with the user’s normal applications | Interactive-desktop prompts can be spoofed; assess exposure before deployment |
Check scope and prerequisites before creating the policy
Use a controlled target rather than changing every Windows device at once. The setting is managed as a Windows UAC security option through Intune, so the people creating and assigning the policy need permission to manage device configuration and groups in the tenant.
- Confirm that the target devices are enrolled in Intune and are in the security group you intend to use for the assignment.
- Confirm the Windows edition and version against Microsoft’s current Policy CSP reference. The documented CSP support starts with Windows 10 version 1709 and includes Pro, Enterprise, Education, and IoT Enterprise editions; verify that those requirements still match your fleet before rollout.
- Identify the other UAC policies that determine consent, credentials, and standard-user elevation. Documenting those settings first prevents a prompt-location change from being mistaken for an authorization change.
- Choose a small pilot group that represents the remote-support and administrative workflows you care about. A pilot is operational guidance for reducing deployment risk, not a Microsoft requirement.
Create the Intune Settings catalog policy
The Settings catalog is Microsoft’s documented Intune configuration path for this policy. Labels can move slightly as the Intune admin center changes, but the policy name and category are the identifiers to verify.
- Open the Microsoft Intune admin center and go to Devices > Windows > Configuration.
- Select Create (or Create policy), choose the Windows platform for the managed devices, and select Settings catalog as the profile type.
- Give the profile a purpose-specific name, such as UAC prompts – interactive desktop pilot. Add a description that records the owner, intended group, and security review date.
- On the settings selection page, search for Switch to the secure desktop when prompting for elevation. Add the setting from Local Policies Security Options.
- Open the added setting and set User Account Control: Switch to the secure desktop when prompting for elevation to Disabled. Do not change the separate administrator or standard-user prompt settings unless that is an intentional, separately reviewed change.
- Review the configuration, then create the profile. Keep the profile unassigned until the target group and pilot plan have been checked.
Assign the policy to a limited group
Open the new profile’s Assignments page and add the security group containing the pilot devices or users. Select the group type that matches how your organization manages Windows configuration, and exclude any test devices that must retain the default behavior. Save the assignment and record the included and excluded groups.
Rank #2
- STREAMLIMED AND INTUITIVE UI | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- JOIN YOUR BUSINESS OR SCHOOL DOMAIN for easy access to network files, servers, and printers.
- OEM IS TO BE INSTALLED ON A NEW PC WITH NO PRIOR VERSION of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE PRODUCT SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
After the assignment is saved, check the profile’s monitoring view for assignment and device status. A device that has not checked in will not show the new behavior immediately. Intune status confirms policy processing; it does not by itself prove that a particular UAC prompt was displayed on the expected desktop.
Verify the behavior on a pilot device
Use a non-production or otherwise approved pilot device. The exact timing depends on the device’s check-in schedule and local activity, so do not treat an immediate result as guaranteed.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Confirm that the device appears in the profile’s device-status results and that no assignment or applicability error is reported.
- On the device, trigger a normal operation that requires elevation, such as an approved administrative tool or installer. Use a request that is safe to cancel.
- Observe whether the UAC dialog remains on the interactive desktop instead of switching to the secure desktop. Record the signed-in account type and whether Windows asked for consent or credentials.
- Compare the observed result with the separate UAC prompt policies documented for that account type. A prompt that still requests credentials is not evidence that the secure-desktop setting failed; credential behavior is controlled elsewhere.
- Test the remote-support workflow that motivated the change, including reconnecting or handing control back to the user if that is part of your process. Record any application, accessibility, or session-specific limitations.
If the pilot behaves as intended and the security review accepts the exposure, expand the assignment in stages. Keep an owner and rollback procedure attached to the profile so the setting can be returned to its default state quickly.
Understand the security trade-off
The secure desktop is a separation boundary for the elevation interface. On the interactive desktop, the prompt shares the same visual space as ordinary applications. Microsoft security guidance warns that prompts shown there can be spoofed. A malicious process could attempt to draw a look-alike dialog or otherwise persuade a user to approve an action.
That risk is not identical for every organization. Consider the users who receive prompts, the software allowed to run on their desktops, the degree of remote control used by support teams, and how frequently users are trained to verify an elevation request. A workflow that requires users to approve prompts while a technician is connected may benefit operationally, while a highly hostile or tightly controlled endpoint population may have little reason to give up the secure desktop.
Rank #3
- WINDOWS 11 PRO FOR WORKSTATIONS is for people with advanced needs such as data scientists, CAD professionals, researchers, media production teams, graphic designers, and animators.
- WINDOWS 11 PRO FOR WORKSTATIONS helps power through advanced workloads while providing server-grade data protection and performance, and includes all the features of Windows 11 Pro | Users will benefit from greater speed with faster processing and file transfers, greater resilience with server-grade storage, and the full power of high-performance hardware configurations.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine | Windows 11 Pro for Workstations is required licensing for systems with Intel Xeon or AMD Opteron processors.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- Keep Enabled when separation of the elevation interface is more important than uninterrupted interactive or remote sessions.
- Use Disabled selectively when the desktop context is a documented operational obstacle and the organization can accept, mitigate, and monitor the spoofing risk.
- Review the decision periodically after changes to remote-support tooling, application allow-listing, user populations, or threat models.
Do not confuse prompt location with elevation permission
Several UAC controls appear next to one another in policy tools but answer different questions:
Administrator prompt behavior
Separate administrator policy settings determine whether an administrator is asked to provide consent, credentials, or another response when an elevation request occurs. Changing the secure-desktop switch does not select among those behaviors.
Standard-user prompt behavior
Standard-user policies determine how Windows handles a request from an account without administrative rights, including whether credentials are required and how the request is presented. Those settings remain in force when the prompt is moved to the interactive desktop.
UIAccess applications
Allow UIAccess applications to prompt for elevation without using the secure desktop is a different setting. It addresses trusted accessibility applications that need to interact with the user interface. It is not a general replacement for the secure-desktop switch and does not change ordinary administrator prompt behavior. Avoid enabling it as a workaround for a remote-support issue unless the accessibility-specific use case and trust requirements are actually present.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Policy CSP and platform details
For administrators who manage configuration through CSP-based tooling, the corresponding setting is UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation under the device URI ./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/. The CSP reference lists device scope and Windows 10 version 1709 and later for supported Pro, Enterprise, Education, and IoT Enterprise editions.
Rank #4
- Windows 11Pro for Workstations
Intune’s Endpoint Protection settings reference maps Route elevation prompts to user’s interactive desktop to the same CSP setting. In that mapping, Enabled routes requests to the interactive desktop, while Not configured routes requests to the secure desktop regardless of the administrator and standard-user prompt behavior policies. Because the Settings catalog exposes the underlying Local Policies Security Options label directly, use that documented path for a new profile and verify current platform and edition requirements before relying on CSP behavior in an existing configuration.
Troubleshoot an unexpected result
The prompt still appears on the secure desktop
- Check that the device or user is actually in the assigned group and that no exclusion takes precedence.
- Review the profile’s per-device status for conflict, applicability, or processing errors.
- Allow the device to check in, then trigger a fresh elevation request. A stale local policy can make a newly assigned setting appear ineffective.
- Look for another configuration profile, security baseline, or CSP assignment configuring the same UAC setting. Resolve the conflict rather than layering competing values.
- Verify the Windows edition and version against the current CSP and Intune documentation.
The prompt location changed, but the user still needs credentials
This is normally expected when the administrator or standard-user prompt policy requires credentials. Recheck those separate settings; moving the prompt does not alter them.
Remote support is still interrupted
Confirm that the interruption was caused by the secure-desktop transition rather than by the remote-control product’s own elevation, session, or input-handling limitations. Test with the same account type and support workflow used in production, and keep the UAC policy change isolated so other causes can be identified.
You need to roll back
Edit the profile and set the secure-desktop switch back to Enabled, then keep the same assignment or target a rollback group. Monitor policy status and repeat the approved elevation test. Explicitly setting Enabled makes the intended default clear; do not assume that removing an assignment has the same result as setting the value.
Make the deployment decision
Disabling User Account Control: Switch to the secure desktop when prompting for elevation is a narrowly scoped way to keep UAC dialogs on the interactive desktop through Intune. The complete control path is a Settings catalog profile under Local Policies Security Options, assigned to the intended security group. The operational benefit is a less disruptive prompt context; the cost is losing the secure desktop’s isolation and accepting greater spoofing exposure. Decide with those two outcomes in view, validate on a representative pilot, and leave the separate elevation-permission policies unchanged unless they have their own approved change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
