Windows · Windows Server  ·  medium  ·  Security, BitLocker & identity

Elevation fails — "this app has been blocked for your protection" or nothing happens

Elevation is being refused — by SmartScreen on the publisher, by a software restriction policy, or because UAC itself has been broken.

What you see

"An administrator has blocked you from running this app", or clicking Run as administrator does nothing at all, or the prompt appears and the application still starts unelevated.

What is actually wrong

A revoked or expired publisher certificate triggers the block message. A group policy under Software Restriction Policies or AppLocker produces a similar one. A UAC prompt that never appears usually means the consent process cannot start, or the secure desktop is failing.

Codes and articles

This app has been blocked for your protection0x800704ecAdministrator has blockedUAC prompt not appearing0x80070522

Fixes (3)

Check the publisher's signature
Elevated PowerShell15 minutesmedium riskreversible

"This app has been blocked for your protection" naming a publisher.

  1. Read the signature. An expired or revoked certificate is the most common cause and it says so.

    PowerShell
    Get-AuthenticodeSignature 'C:\path\setup.exe' | Format-List Status,StatusMessage,SignerCertificate

    A revoked certificate means the publisher's signing key was compromised or withdrawn. That is a real reason not to run the file, and it is worth checking for a newer signed version from the vendor before bypassing it.

  2. Get a current version from the vendor. Old installers with expired certificates are extremely common and a fresh download usually resolves it outright.

  3. If it must be run, unblock it and run from an elevated prompt rather than turning UAC off.

    PowerShell
    Unblock-File 'C:\path\setup.exe'

  4. As a last resort for a trusted internal tool, launch it from an already-elevated PowerShell session, which bypasses the shell's publisher check without weakening anything system-wide.

Confirm it workedThe installer runs and the signature check on the new version returns Valid.
If you need to undo itNothing system-wide was changed.
Find the policy doing the blocking
Elevated PowerShell25 minutesmedium riskreversible

"An administrator has blocked you from running this app".

  1. Check AppLocker first — its log names the rule and the file.

    PowerShell
    Get-WinEvent -LogName 'Microsoft-Windows-AppLocker/EXE and DLL' -MaxEvents 30 -ErrorAction SilentlyContinue | Format-Table TimeCreated,Id,Message -Wrap

  2. Check Software Restriction Policies, which are older and easier to miss.

    PowerShell
    Get-ChildItem 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers' -ErrorAction SilentlyContinue -Recurse | Select-Object -First 20 Name

  3. Get the applied policy report on a domain machine rather than editing keys locally.

    PowerShell
    gpresult /h $env:USERPROFILE\Desktop\gpo.html /fStart-Process $env:USERPROFILE\Desktop\gpo.html

    The report names the GPO, so the exception is added once in the right place rather than locally on each machine, where the next policy refresh undoes it.

  4. Add a publisher or hash rule for the specific application in the responsible GPO, in preference to a path rule, which is the weakest kind.

Confirm it workedThe application runs and the AppLocker log shows it allowed rather than blocked.
If you need to undo itRemove the rule from the GPO; the block returns at the next refresh.
Repair UAC itself
Elevated PowerShell25 minutesmedium riskreversible

No prompt appears at all, or elevation silently fails.

  1. Check the UAC settings are not disabled.

    PowerShell
    Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' | Format-List EnableLUA,ConsentPromptBehaviorAdmin,PromptOnSecureDesktop,FilterAdministratorToken

  2. EnableLUA set to 0 turns UAC off entirely, which also breaks every Store app and many modern features. Set it back to 1 and restart.

    PowerShell
    Set-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name EnableLUA -Value 1 -Type DWord

    A machine with EnableLUA at 0 runs every process with a full administrator token. It is not just a missing prompt — it removes the boundary that stops a browser exploit becoming a system compromise.

  3. If prompts flash and vanish, disable the secure desktop temporarily to see the dialog and any error on it.

    PowerShell
    Set-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name PromptOnSecureDesktop -Value 0 -Type DWord

  4. Check the Application Information service, which performs the elevation.

    PowerShell
    Get-Service Appinfo | Format-List Status,StartTypeSet-Service Appinfo -StartupType Manual

  5. Restore the secure desktop once diagnosed.

    PowerShell
    Set-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name PromptOnSecureDesktop -Value 1 -Type DWord
Confirm it workedRight-click → Run as administrator produces a prompt on the dimmed desktop and elevates.
PowerShell
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' | Format-List EnableLUA,PromptOnSecureDesktop
If you need to undo itEach value above can be set back to what step one recorded.

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.