Enumerate administrator accounts on elevation
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators
This machine-wide registry value controls whether Windows displays the computer's local administrator accounts for selection when an elevation request requires credentials.
The value uses the REG_DWORD type:
1: Windows displays all local administrator accounts. The user can select an account and must then enter its valid password.0: No account list is displayed. The user must enter both a user name and password to elevate.- Not present: Administrator accounts aren't displayed by default.
The setting affects the presentation of credentials when a running application is elevated. It doesn't grant administrative privileges or eliminate the authentication requirement.
Notes
Security
Displaying the account list exposes the names of local administrator accounts to users who initiate an elevation request. A user therefore doesn't need prior knowledge of a valid local administrator account name. The setting neither reveals nor bypasses passwords; successful elevation still requires valid credentials.
Microsoft security baselines for Windows Server treat 0 or an absent value as the expected state.
Possible side effects
Without the account list, users must supply both the account name and password. This can make entry of administrative credentials less convenient and more susceptible to typing or account-selection errors. Enabling enumeration simplifies the prompt, particularly on computers with multiple local administrator accounts.
Notes
This setting changes only whether local administrator accounts are listed in the credential prompt. It doesn't modify local Administrators group membership, UAC requirements, or the permissions assigned to a successfully elevated process.
Microsoft documentation
Microsoft Learn: Policy CSP – CredentialsUI
Microsoft Learn: Azure Policy guest configuration baseline for Windows Server 2025