Overview
Running apps as administrator grants powerful privileges. On a shared computer, you may want to stop a specific app from running elevated, or remove the "Run as administrator" option altogether so standard users cannot elevate. This guide shows how.
You can stop apps from running elevated or remove the option entirely.
Warning: Editing the registry or security policy affects all elevation. Back up the registry and create a restore point first, and keep an admin account available.
Key Takeaways
- Untick "Run this program as an administrator" in a program’s Compatibility settings to stop it elevating.
- Remove the context-menu "Run as administrator" via the registry.
- Local Security Policy can deny elevation to standard users entirely.
- Keep at least one administrator account so you can manage the PC.
Method 1 — Stop a Specific Program Running as Admin
1. Right-click the program’s shortcut or .exe and choose Properties.
2. Open the Compatibility tab.
3. Untick "Run this program as an administrator", then click OK.
4. If it is greyed out, click "Change settings for all users" first.
The "Run as administrator" option in a program’s Compatibility tab.
Method 2 — Remove "Run as Administrator" From the Context Menu
Warning: Registry edit — back it up first (File > Export).
1. Open Registry Editor (regedit).
2. Go to HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers and the runas keys (and exefile\shell\runas).
3. Rename or remove the runas command keys to hide the option (note the original names to restore later).
4. Sign out and back in to apply.
Method 3 — Deny Elevation to Standard Users
1. Press Windows key + R, type secpol.msc, and press Enter (Pro/Enterprise).
2. Go to Local Policies > Security Options.
3. Open "User Account Control: Behavior of the elevation prompt for standard users".
4. Set it to "Automatically deny elevation requests", then click OK.
5. Standard users can no longer run apps as administrator.
Troubleshooting
Problem: An app needs admin rights and now fails.
Solution: Re-enable elevation for that specific app (Compatibility tab), or grant it where required — block only what you intend to.
Problem: secpol.msc is not available.
Solution: Local Security Policy is Pro/Enterprise only. Use the equivalent registry value (ConsentPromptBehaviorUser under the UAC policies key) on Home.
Problem: You removed the context-menu option and want it back.
Solution: Restore the renamed/exported registry keys, or import your backup.
Problem: You locked yourself out of elevation.
Solution: Sign in with an administrator account and reverse the security policy or registry change.
Conclusion
You can curb elevation at several levels: stop a single app via its Compatibility tab, hide the context-menu option via the registry, or deny elevation to standard users with Local Security Policy. Keep an admin account handy and back up before changing system-wide settings.
</w:pBdr><w:spacing w:before="220" w:after="40"/></w:pPr><w:r><w:rPr><w:b/><w:bCs/><w:color w:val="0B5394"/><w:sz w:val="21"/><w:szCs w:val="21"/><w:rFonts w:ascii="Calibri" w:cs="Calibri" w:eastAsia="Calibri" w:hAnsi="Calibri"/></w:rPr><w:t xml:space="preserve">About TechHub
This guide is part of the TechHub Knowledge Base. For more step-by-step IT guides and support, visit techhub.com.lk.
