What just happened (and why it matters)
- August 2025 security hardening for Windows Installer introduced stricter elevation behavior, which surfaced unexpected UAC prompts during MSI repair/per-user config for standard users.
- September 2025 updates narrowed when prompts appear and added an OS allow-list so IT can quiet prompts for specific trusted apps (e.g., those with elevated custom actions).
- Real-world impact: First-run repairs for suites like AutoCAD triggered admin prompts and, in some scenarios, failures—painful for enterprise rollouts.
Don’t “solve” this with local admin
- Creates a standing high-value token attackers can abuse.
- Violates least-privilege guidance and best practices from major authorities.
- Kills visibility: you lose event-level attribution for sensitive actions.
The controlled-elevation playbook (fast)
- Identify the exact elevation moment. Reproduce as a standard user; use Process Monitor to catch ACCESS DENIED on HKLM\, Program Files, service control/COM registrations. For MSI, run verbose logs (msiexec /i app.msi /l*v c:\temp\app.log).
- Decide: fix or broker. Prefer app fixes (move writes to user paths, ACL corrections, shims). If the vendor can’t change soon, broker elevation for the exact binary/operation that needs it.
- Scope narrowly. Match on file/publisher/hash, constrain command-line, expected verb (install/repair), and known path. Optionally restrict to maintenance windows. Log every elevation with user, device, hash, and arguments.
- Use the OS allow-list sparingly to reduce unnecessary prompts—then use Elevator to broker the admin action itself with per-app scope and full audit. This keeps users standard, preserves least-privilege, and gives you evidence of what was elevated, by whom, and when.
- Monitor backslides. Alert on changes to the local Administrators group and unusual installer/repair activity on endpoints.
How the OS allow-list and Elevator fit together
- OS allow-list: reduces or suppresses prompts for known-good apps after the 2025 change. It does not grant approvals, time-bound rights, or an audit trail.
- Elevator: grants just enough privilege for the specific admin operation (install/repair/service/COM), with tight scoping, optional approvals, centralized policy, and full logging.
- Result: smoother UX and defensible least-privilege—even when legacy apps still need admin moments.
If you’re affected today
- Ensure your test ring is on the September 2025 (or later) update to gain the reduced scope and allow-list option.
- Inventory impacted apps (tickets about first-run failures, MSI repair errors like 1730, surprise UAC prompts).
- Pick 2–3 priority apps; implement controlled elevation rules while you pursue vendor fixes.
- Remove any “temporary” local admin grants used as a stopgap.
Try it with Elevator
Elevator brokers per-app, audited admin operations without granting users local admin. Version your policies, roll out safely, and keep a clean audit trail.Further reading
- Microsoft: Unexpected UAC prompts after the August 2025 security update + September allow-list mitigation
- Autodesk: Admin prompt/first-run repair impact notes
- Coverage: BleepingComputer, Petri, Tom’s Hardware
- CISA: Remove unnecessary local admin; enforce least privilege
