UAC Yes Button Grayed Out in Windows 11 and 10: The Fix

Open Command Prompt and run net localgroup administrators. If your username is not in the list that prints, that is your answer — and if another admin account exists, one command from it fixes this in two minutes.

net localgroup administrators YourUsername /add

But before you run anything, understand what the gray button actually is, because it changes where you look.

It is not a bug. It is the answer. Windows has decided this account cannot elevate, and rather than telling you so in words, it draws the Yes button and switches it off. A refusal, rendered as a malfunction.

That single design choice is why this problem sends people hunting for repair tools, registry hacks and reinstalls. Nothing on your machine is damaged. Your account is simply not in the Administrators group any more — and it is worth knowing that Windows will let you remove your own last administrator without warning you what that means.

Which raises the question Jake's customer ran into, and it is the one this page really exists for: what do you do when there is no other administrator left to fix it with?

The Laptop With Nobody In Charge

A customer brought Jake a laptop that had stopped letting him install anything. Every installer raised the User Account Control box, and every time, the Yes button sat there gray and unclickable. He had been living with it for a fortnight by treating it as a Windows fault he would get around to.

Jake's first assumption was the same one most people make: something in Windows had broken and needed repairing. He ran the file checker. He looked for a registry fix. He found three forum threads recommending three different registry edits and, sensibly, did not run any of them.

Then he checked the thing he should have checked first, and it took nine seconds:

net localgroup administrators

The customer's account was not in the list. That explained the gray button completely — and it should have been a two-minute fix, because you sign in as some other administrator and add the account back.

Except the list had a second thing wrong with it. Apart from a disabled built-in account, there were no administrators on that machine at all. Nobody. The customer had, at some point, changed his own account to Standard while tidying up family accounts, and Windows had let him do it without a word.

So the easy fix was unavailable, and the machine was now in a state where nothing could ever be installed, changed or repaired from inside Windows again.

That is the situation the second half of this page is about. But it starts with the nine-second check, because most people are one command away from being finished.

The Gray Button Is a Sentence, Not a Symptom

User Account Control shows two different dialogs, and knowing which one you are looking at tells you most of what you need.

What you see	What Windows is saying	Where to go
Yes and No, both clickable	You are an administrator. Confirm and continue.	Normal. Nothing wrong.
A username and password box	You are a standard user, but an admin account exists. Enter its details.	Also normal, and the good case.
Yes, grayed out	This account cannot elevate, and there is nothing to offer you instead.	The rest of this page.
No prompt, silently denied	Policy is refusing before the prompt is drawn.	The policy section

Row three is a statement about your account, not about Windows. Every repair tool in the world will find nothing wrong, because nothing is wrong — the machine is behaving exactly as designed for an account without rights.

Ethan's framing, which Jake now uses on customers: "It's the difference between a door that's jammed and a door that's locked. You can spend all afternoon oiling the hinges on a locked door. The gray button means locked. Go and find the key instead."

So the first job is not to fix anything. It is to find out how many keys exist on this machine — because that number decides which of the four routes below you are on.

The Nine-Second Check That Decides Everything

You do not need admin rights to run these, which is the point.

1. Press the Windows key, type cmd, and press Enter. An ordinary prompt is fine here — do not try to run it as administrator, because you cannot.
2. Run net localgroup administrators. This prints every account that genuinely holds admin rights.
3. Look for your username. Absent? That is the gray button explained.
4. Now look at the whole list. This is the part people skip and it decides your route. Is there another usable account there, or only a disabled built-in one?
5. For a second opinion on your own account, run whoami /groups and look for BUILTIN\Administrators. If Settings claims you are an administrator and this does not, believe this one.

That last point matters more than it sounds. Settings can keep showing an account as Administrator after group membership has changed underneath it, which is exactly why people arrive at this page insisting they are already an admin. They are not wrong about what they read — the screen genuinely said so.

You now know which of the next four sections is yours. They run from a two-minute fix to a rescue from outside Windows, and you want the earliest one that applies.

Route 1 — Another Administrator Exists

Most people are here, and it really is two minutes.

Sign out and sign in to the other administrator account — a partner's account, an old setup account, anything the list showed. Open Command Prompt as administrator from there, and run:

net localgroup administrators YourUsername /add

Use the exact username as it appeared in the list, in quotes if it contains a space. Sign out, sign back into your own account, and the Yes button is live again.

If you would rather click than type, the same job is Settings, Accounts, Other users, select the account, Change account type, Administrator. Either works. The command is more reliable on a machine that is already misbehaving, and our guide to opening an elevated prompt covers the routes that still work when the Start menu is uncooperative.

While you are in that admin account, do the thing that stops this page ever being needed again: check there are now two administrators. If there is only one, you are one careless click from the situation in the next section.

Route 2 — No Other Admin, but Windows Still Starts

This is Jake's customer. No account on the machine can elevate, so there is nobody to grant anything to anybody.

Windows has an answer to this, and almost nobody knows it exists. Every installation carries a built-in Administrator account — sometimes called the super administrator — created during setup and left disabled. It has full rights and receives no UAC prompts at all. Microsoft keeps it switched off because an always-elevated account is a security risk, but it is there precisely so a machine can be rescued from this state.

In Safe Mode, it appears on the sign-in screen even while disabled for normal use.

1. From the sign-in screen or the Start menu, hold Shift and click Restart. No admin rights are needed for this.
2. Choose Troubleshoot → Advanced options → Startup Settings → Restart.
3. When the numbered list appears, press 4 for Safe Mode.
4. At the sign-in screen, look for Administrator — usually bottom left. Sign in to it. There is normally no password.
5. Open Command Prompt and run net localgroup administrators YourUsername /add.
6. Restart normally, sign in as yourself, and the Yes button works.

Ignore any guide telling you to press F8 to reach this menu. F8 has not opened it since Windows 7, and following that advice is how people conclude Safe Mode is unavailable to them. Our walkthrough on entering Safe Mode covers the routes for machines that will not cooperate, and our guide to the built-in super administrator account explains what it is and why to switch it back off afterwards.

That last part is not optional housekeeping. Leave that account enabled and you have a permanently elevated, usually password-free account on the machine — which is a worse problem than the one you started with. Turn it off once your own account is repaired.

And if the Administrator account is not on that Safe Mode sign-in screen at all, you are on the next route.

Route 3 — The Built-In Account Is Disabled Too

Now there is genuinely no way to elevate from inside Windows, so you go outside it.

You will need Windows installation media — a USB stick made with Microsoft's Media Creation Tool, which you can build on any other computer. Boot from it, and instead of installing anything, choose Repair your computer, then Troubleshoot, then Command Prompt.

From that prompt you are working on the installed Windows from outside, with no permission checks in the way. Enable the built-in account against your Windows installation:

net user administrator /active:yes

Check your drive letter first. The recovery environment frequently assigns different letters than the ones you see day to day, so confirm where Windows actually lives before running anything against it.

Restart, sign in as Administrator, add your own account back to the group as in Route 1, then disable the built-in account again.

This sounds like a big undertaking and it is about twenty minutes, most of it waiting for the USB stick to be written on another machine. It is dramatically less work than the thing people reach for at this point, which is reinstalling Windows.

Route 4 — When Even That Will Not Take

Rare, but it happens: the commands run without error and the rights still do not stick, usually because the account database or the profile itself is damaged rather than merely misconfigured.

The step here is an in-place upgrade, and it is worth being precise about what that means because it is routinely confused with the destructive option. Run the Media Creation Tool from inside your running Windows — not from the boot USB — and choose to keep personal files and apps. It reinstalls the system layer over the top, repairing account and permission structures, and leaves your programs, settings and documents where they are.

It takes about an hour. What it is not is a Reset, which removes your installed applications. If anybody advises resetting the PC to fix a group membership problem, the in-place upgrade is the same idea without the cost.

Take a backup first anyway. Not because this is risky, but because you have just spent an evening discovering how quickly a working machine can become one you cannot administer.

When It Is Policy, Not Group Membership

One variation looks identical and has a completely different cause. If net localgroup administrators lists your account correctly and the button is still gray, group membership is not your problem.

Windows has a policy governing how the elevation prompt behaves for standard users, and one of its settings is to automatically deny every elevation request. With that in force, no prompt can ever be accepted by anyone it applies to, regardless of what group they are in. There are matching registry values behind it, under the system policies key, which some tune-up scripts set without explaining what they do.

On a work or school laptop, this is almost certainly deliberate. Your IT team has decided that machine does not self-administer, and the answer is a conversation with them rather than a workaround. Attempting to bypass it is both likely to fail and likely to be noticed.

On a personal machine where you did not set it, it usually arrived with an optimization script. Fixing it means putting the policy back to prompting rather than denying — and if a script did that to your UAC settings, it is worth finding out what else it changed. Our post on the UAC settings and how to restore them covers where those controls live.

How an Account Loses Its Rights Without Anyone Noticing

This is the part Jake's customer wanted answered once the laptop was working: how had it happened at all, given he had never deliberately removed his own rights?

How it happens	Why nobody notices at the time
Changing an account type in Settings while tidying up family accounts	Windows does not warn you that you are demoting the last administrator
A "debloat" or optimization script removing accounts from groups	Nothing visible changes until the next time you install something
A profile rebuilt after a repair or a sign-in problem	The new profile does not inherit the old group membership
A second-hand machine handed over with the setup account removed	Everything works until the first elevation is needed
Switching a local account to a Microsoft account mid-repair	Settings keeps displaying the account as Administrator

Every row has the same shape: the change is silent, and the consequence arrives weeks later attached to something unrelated. That gap is why this reads as a Windows fault rather than a settings change — by the time the gray button appears, whatever caused it is long forgotten.

Which is worth saying plainly if you have been blaming yourself for a fortnight: you were not careless. Windows let a last administrator be removed without a single confirmation, and then reported the result as a broken button.

The Two-Minute Habit That Ends This

Keep two administrator accounts on any machine that matters. That is the whole prevention strategy and it costs nothing.

Create a second local account, make it an administrator, give it a password you have written down somewhere sensible, and then never use it. It sits there consuming nothing. The day something like this happens, it turns a Safe Mode expedition into the two minutes of Route 1.

Ethan's version, delivered to Jake as a shop policy: "Every machine that leaves here gets a spare admin account. Customers think it's fussy. It costs me ninety seconds and it's saved me an afternoon four times this year. You're not building it for today, you're building it for the day somebody clicks something."

If you also want the security benefit, run day-to-day on a standard account and keep both admin accounts for elevation only. That is genuinely safer than working as an administrator all day, and with two admins in reserve it costs you nothing in convenience. Our guides on enabling and disabling user accounts and resetting another user's password from an admin account cover the account management around it — the second one especially, because it explains what an admin reset costs the other user.

What This Page Said in 2016

The original version of this post went up in February 2016 and sent everybody straight to Safe Mode and the built-in Administrator account. Those steps were right, and they are still Route 2 here.

What it did not do was ask first. It opened by describing the error as something that happens "even when we are already logged in as Admin" — and then never checked whether that was true. For most readers it was not: they had lost admin rights and did not know it, and a nine-second command would have told them, after which the majority would have been finished in two minutes without ever restarting.

So the sequence is inverted now. Check first, and let the answer choose the route. Safe Mode is a real solution, but it is the second one, and sending everyone there first turned a two-minute fix into a reboot for the people who did not need it.

The 2016 version also never explained what the gray button meant, which is the piece that stops the panic. Steps without a diagnosis leave you fixing something you do not understand and hoping.

Your Questions, Answered Straight

Why is the Yes button grayed out in User Account Control?

Because the account you are signed into is not a member of the local Administrators group. Windows draws the Yes button and disables it rather than saying you lack permission, which makes an answer look like a fault. The button is not broken — it is the reply.

But Settings says I am an administrator. Why is it still gray?

Check it a second way before believing it. Run whoami /groups in a Command Prompt and look for BUILTIN\Administrators in the list. Group membership can be changed without the Settings screen catching up, and a profile that once had admin rights can keep looking as though it still does.

How do I check whether my account really has admin rights?

Open Command Prompt and run net localgroup administrators. That prints every account that genuinely holds admin rights on the machine. If your username is not in that list, the gray button is explained, and if the list is nearly empty you have found a second and larger problem.

What is the fastest fix if another admin account exists?

Sign in to that account, open Command Prompt as administrator, and run net localgroup administrators YourUsername /add. Sign out, sign back into your own account, and the Yes button works. The whole repair takes under two minutes when a second administrator is available.

What if there is no other administrator account?

Use the built-in Administrator account, which every Windows installation has and which is disabled by default. Boot into Safe Mode, where it appears on the sign-in screen, sign in to it, and add your own account back to the Administrators group. This is the situation that account exists for.

How do I get into Safe Mode if I cannot elevate anything?

You do not need admin rights to reach it. Hold Shift while clicking Restart on the sign-in screen or the Start menu, then choose Troubleshoot, Advanced options, Startup Settings, Restart, and press 4. The F8 key has not opened this menu since Windows 7, so ignore guides that tell you to press it.

What is the built-in Administrator account?

A hidden account created during installation and left disabled, sometimes called the super administrator. It has full rights and no UAC prompts at all. Microsoft disables it because an always-elevated account is a security risk, but it exists precisely so a machine can be rescued when normal accounts lose their rights.

What if the built-in Administrator is disabled too?

Boot to the recovery environment from Windows installation media, open Command Prompt there, and enable it with net user administrator /active:yes against your Windows installation. From that account you can restore your own. This is the last route that works from outside a running Windows.

Can Group Policy cause the Yes button to be grayed out?

Yes, and it looks identical. The setting that governs it is the elevation prompt behavior for standard users, and when it is set to automatically deny elevation requests, no prompt can ever be accepted. On a work laptop this is deliberate and the answer is to ask whoever manages it rather than to work around it.

How does an account lose its administrator rights in the first place?

Usually somebody changed an account type in Settings without realizing it was the only administrator, or a cleanup script removed accounts from groups, or a profile was rebuilt after a repair. It is rarely dramatic and rarely anybody's fault — Windows will let you demote your last administrator without warning you what that means.

Is a grayed-out Yes button a sign of malware?

It can be, because removing admin rights is a way to stop you undoing changes, but it is far more often an ordinary configuration accident. Run a full Microsoft Defender scan once from a working administrator account so it is ruled out, then treat it as the permissions problem it almost certainly is.

Will resetting or reinstalling Windows fix it?

It would, and it is almost never necessary. Every route on this page restores admin rights without touching your files or programs, and an in-place upgrade is the heaviest step that should ever be needed. Reinstalling to fix a group membership is a very expensive way to run one command.

Can I add my account to the Administrators group from Settings instead?

Yes, from an account that already has admin rights: Settings, Accounts, Other users, select the account, Change account type, Administrator. The command line version does the same thing and is more reliable when the Settings app itself is misbehaving, which it sometimes is on a machine in this state.

Why does Windows show a button I cannot press?

Because the dialog is built once and then disabled where rights are missing, rather than being replaced with an explanation. It is a design choice that turns a clear answer into an apparent malfunction, and it is the single reason this problem sends people looking for a repair tool instead of checking their account type.

How do I stop this happening again?

Keep two administrator accounts on any machine that matters, and use a standard account for daily work if you want the security benefit. The second admin costs nothing, sits unused, and turns this entire page into a two-minute fix rather than a Safe Mode expedition.

Does this apply to Windows 11 as well as Windows 10?

Yes. The cause, the commands and the recovery routes are identical on both. Some Settings screens have moved and Safe Mode looks slightly different, but nothing in the diagnosis or the repair depends on the version you are running.

Worth Reading Next

Revision note. Originally published February 16, 2016. Rewritten August 22, 2026 for Windows 11 and Windows 10. The Safe Mode route from the original is still here and still correct — it has simply moved to second place, because the original sent everyone there without first checking whether they had lost admin rights at all. Most readers had, and a nine-second command finishes the job for them without a restart. Also new: what the gray button actually means, the four routes in order of severity, the Group Policy variation that looks identical, and an honest list of how accounts lose their rights silently. If your machine behaves differently from anything here, please write in and tell us what net localgroup administrators printed — that one line usually explains the rest. And if you have been living with this for weeks assuming you had broken something: you had not. Windows removed a last administrator without asking, then reported it to you as a button that would not work.