We enforce the UAC on all our Windows 2008 servers. It is done via GPO with all the settings recommended for the 'Enterprise' enabled, including setting 'Admin-approval mode for builtin ...