Fix User Account Control Prompts Appearing Twice on Windows 11

Quick fix: Double UAC prompts almost always mean a third-party app installer that wraps an MSI inside a setup EXE — both layers request elevation. The fix isn’t to disable UAC; it’s to identify the cause. Open Event Viewer → Security log and filter by Event ID 4673 — you’ll see exactly which two processes triggered UAC.

You launch an installer or click a system-modifying option. UAC prompts you. You click Yes. UAC prompts you again with the same publisher info, sometimes within a second. You click Yes again, and the program proceeds. The doubling is annoying but rarely harmful — the cause is usually a legitimate installer pattern, occasionally a misconfigured EXE manifest, very rarely a sign of malware.

What causes this

UAC prompts are triggered when a process requests elevation to administrator privileges. Some apps are legitimately structured to elevate twice: an outer launcher EXE elevates to verify code signing or check for updates, then launches an inner setup MSI/EXE that also requests elevation. Common pattern in installers from Adobe, certain Java updaters, and some OEM utilities.

Other causes: a misconfigured app manifest declaring requireAdministrator on both a launcher and its child, the Application Compatibility Toolkit setting an explicit run-as-admin shim, or a Group Policy that forces re-elevation on each spawned process.

Method 1: Identify which two processes are prompting

Knowing the cause is half the fix. Don’t just disable UAC.

1. Open Event Viewer: Win + R → eventvwr.msc.
2. Navigate to Windows Logs → Security.
3. Click Filter Current Log in the right pane. Filter for Event ID 4673 (Privileged Service Called) and 4688 (Process Creation).
4. Trigger the double UAC by launching the app that prompts twice.
5. Return to Event Viewer. Look for the most recent two 4688 events. Each shows New Process Name — note the two paths.
6. If they’re different files (one ParentProcess, one child), the parent likely launches the child with elevated privileges and the child also requests elevation. Solution: extract the actual installer (MSI or inner EXE) and run it directly, bypassing the wrapper.
7. If they’re the same file: the app’s manifest specifies double-elevation. Check by running sigcheck.exe -m <path_to_exe> from Sysinternals — look for <requireAdministrator/> entries in the embedded manifest.

This diagnosis tells you whether to fix the launcher pattern (Method 2) or the manifest (Method 3).

Method 2: Run the inner installer directly

For when the doubled prompts come from a wrapper EXE that launches an MSI or another EXE.

1. Locate the wrapper EXE. Right-click → Properties → Compatibility tab. If Run this program as administrator is ticked, untick it — sometimes that’s redundant with the manifest’s requireAdministrator declaration.
2. Many installer wrappers extract their inner files to %TEMP% while running. Run the wrapper as far as the first UAC, click Yes, then before clicking Yes on the second UAC, open %TEMP% and look for newly created subfolders.
3. Inside the temp folder, you’ll typically see the real MSI file (e.g., Setup.msi). Cancel the running installer. Then double-click the extracted MSI directly to install — it only triggers one UAC prompt.
4. For apps that resist this extraction approach: use 7-Zip to open the wrapper EXE as an archive. Many installers (Inno Setup, NSIS) can be extracted with 7-Zip and contain the inner files.
5. After extracting, run the inner installer. Single UAC.

This is the right approach when the cause is a vendor-side wrapper pattern — you’re bypassing the wrapper rather than “fixing” their installer.

Method 3: Adjust UAC notification behavior

For when the double prompts are annoying but you don’t want to disable UAC entirely.

1. Open Control Panel → User Accounts → Change User Account Control settings. (Search Start → UAC.)
2. Slider has four positions: Always notify, Notify only when apps try to make changes (default, dim desktop), Notify only when apps try to make changes (do not dim desktop), Never notify.
3. The third option (no dim) still prompts but skips the secure desktop transition, which makes back-to-back prompts feel less jarring. Recommended if you can’t avoid double prompts.
4. For developers/sysadmins who run many installers: temporarily set to Never notify for a single session, then revert. Don’t leave it disabled long-term.
5. To permanently allow specific apps to elevate without prompting: use Microsoft’s Task Scheduler trick. Create a task that runs the app with highest privileges, then create a desktop shortcut that runs schtasks /run /tn TaskName. The task runs elevated without UAC because it’s pre-authorized.

The trade-off: less interruption but slightly weaker default security. The Task Scheduler trick is fine for trusted apps; UAC disabling is not recommended.

How to verify the fix worked

• Launch the app that previously double-prompted. UAC appears once, you accept, app runs.
• In Event Viewer, the previously-doubled 4688 events should now show only one process creation per launch.
• If using a Task Scheduler bypass: the app launches without any UAC prompt.

If none of these work

If UAC double-prompts persist even with the wrapper extracted and the app run from the MSI, the cause may be the app’s service spawning a worker process during install that also requires elevation. This is normal for some enterprise software (anti-virus installers, VPN clients, virtualization software) — the install service launches a kernel-mode driver installer that has its own UAC requirement. In this case, the double prompt is a deliberate security design and bypassing it is unsafe. For users who consistently see double UAC across multiple apps not in this category, run Autoruns from Sysinternals and look for shim layers under AppInit DLLs or Image File Execution Options — a third-party application compatibility tool may be wrapping every launched EXE. For pre-installed OEM utilities (Lenovo Vantage, HP Support Assistant) that double-prompt, uninstall them; they re-elevate frequently and aren’t essential.

Bottom line: Double UAC is almost always a legitimate wrapper-installer pattern. Identify the two processes via Event Viewer, then run the inner installer directly to get a single prompt — disabling UAC is the wrong fix.