AFAIK the "GUI" runs separately from the service. At least the programs I have here like MalwareBytes do it that way. I can kill the GUI without admin privileges but the service spawns it again a few seconds later unless you give UAC permission to quit. I'm not a security expert or developer but I think ideally you shold run the GUI as admin since otherwise non privileged apps could interact with it.Thanks for the info. How do all other apps which need root, av, firewalls etc do this but this app can't?