# Ensure 'User Account Control: Behaviour of the elevation prompt for standard users' is set to 'Automatically deny elevation requests

Necessity: This setting governs how User Account Control (UAC) handles elevation requests initiated by standard users. Misconfiguration can create significant security risks. If standard users are allowed to interact with elevation prompts, it could facilitate social engineering attacks where a user is tricked into getting an administrator to enter credentials for a malicious process. Enforcing the principle of least privilege by automatically denying these requests prevents standard user accounts from being a vector for privilege escalation.

Auditing and Remediation: The audit script checks the current configuration by reading the 'ConsentPromptBehaviorUser' registry value, which determines the UAC prompt behavior for standard users. The remediation script directly modifies this registry value to align the system with the desired security policy, thereby altering how UAC responds to elevation attempts.

Recommended State Rationale:
- Strict ('0' - Automatically deny elevation requests): This is the most secure configuration. It strictly enforces the principle of least privilege by preventing any elevation attempt from a standard user account, effectively shutting down this attack vector. This is recommended for all standard user workstations in a secure environment.
- Moderate ('1' - Prompt for credentials on the secure desktop): This setting provides a balance between security and operational needs. While it allows an administrator to provide credentials for elevation, it does so on the secure desktop, which is isolated from the user's session and protects against UI spoofing or message injection attacks. This is a common and reasonably secure default.
- Basic ('3' - Prompt for credentials): This setting also requires administrative credentials but displays the prompt on the standard user's desktop. It is considered less secure than the Moderate state because it is theoretically vulnerable to spoofing by sophisticated malware. It should be considered the minimum acceptable level of security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['3']` |
| **Moderate** | `['1']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value 'ConsentPromptBehaviorUser' at the path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script must return only the current numerical value of this setting (e.g., '0', '1', or '3'). If the value does not exist, it should return a default or indicative value like '-1'.

## Remediation Script Working

PowerShell script that accepts a single numerical command-line argument. The script must set the registry value 'ConsentPromptBehaviorUser' (as a DWORD type) at the path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to the provided argument. The script must return '$true' upon successful modification and '$false' if it fails.

