You still need an elevated account to actually apply the elevated permissions though. If the user tries to install something without Admin rights UAC will pop up asking for credentials of the account with higher rights to install the program. This is where you would need a local account or a domain admin account to let the user install what they want.

More or less, yes, that way is quite similar to the main feature of UAC when running as a local admin. The main difference is that, with UAC, you get some extra features not available in XP (or windows Vista+ with UAC disabled), namely the UIPI thing, filesystem and registry virtualization and the secure desktop for elevation, as well as a more convenient shortcut for becoming and admin. Note that, UAC or not, if you want to make some systemwide changes you need an admin account some way or another. If you start using UAC and remain in your current method of using a standard account for everyday activity, you will end up using the other account for admin task (and UAC asking user/password each time). The way UAC saves the extra domain account is if you make the regular account a local administrator. UAC by itself strips you of your admin membership and when asked to elevate simply shows a yes/no popup, after it gives you full admin power.

You still need an elevated account to actually apply the elevated permissions though. If the user tries to install something without Admin rights UAC will pop up asking for credentials of the account with higher rights to install the program. This is where you would need a local account or a domain admin account to let the user install what they want.

More or less, yes, that way is quite similar to the main feature of UAC when running as a local admin. The main difference is that, with UAC, you get some extra features not available in XP (or windows Vista+ with UAC disabled), namely the UIPI thing, filesystem and registry virtualization and the secure desktop for elevation, as well as a more convenient shortcut for becoming and admin. Note that, UAC or not, if you want to make some systemwide changes you need an admin account some way or another. If you start using UAC and remain in your current method of using a standard account for everyday activity, you will end up using the other account for admin task (and UAC asking user/password each time). The way UAC saves the extra domain account is if you make the regular account a local administrator. UAC by itself strips you of your admin membership and when asked to elevate simply shows a yes/no popup, after it gives you full admin power.

Hi, Actually in our company, with Windows XP, nobody has admin rights with their user account. For people who needs admin right, we are creating another user account in AD (adm-%username%). This admin user is member of the local administrators of the local computer and this account can only be used through the "Runas" command (the user cannot open an interactive session with this account). So basically the user is never connected with an admin right, and if he wants to elevate his privileges, he has to use the RunAs command. Now my question is : UAC is not doing something equivalent but without the need to have a dedicated admin user account ? Thank you

Hi, "With UAC, applications and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC stops the automatic installation of unauthorized applications, and prevents inadvertent changes to system settings. Here are three articles may answer your question. User Account Control Step-by-Step Guide http://technet.microsoft.com/en-us/library/cc709691(v=ws.10).aspx User Account Control Overview http://windows.microsoft.com/en-us/windows-vista/User-Account-Control-Overview How to Change Behavior of User Account Control (UAC) Prompt for Standard Users http://www.sevenforums.com/tutorials/206089-user-account-control-uac-change-prompt-behavior-standard-users.html Ivan-Liu TechNet Community Support