# Ensure 'User Account Control: Run all administrators in Admin Approval Mode' is set to 'Enabled'

Necessity: This setting is the core of User Account Control (UAC). When enabled, it forces all users, including administrators, to run applications with standard user privileges by default. Any task requiring administrative privileges triggers a consent prompt, preventing malware or unauthorized applications from silently making system-level changes. Disabling this setting effectively nullifies a critical defense-in-depth security layer, exposing the system to elevation-of-privilege attacks and making it significantly easier for malware to gain full control.

Auditing and Remediation: The audit script checks the status of this setting by reading the 'EnableLUA' DWORD value from the registry path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. A value of 1 corresponds to 'Enabled'. The remediation script directly modifies this registry value, setting it to 1 to enforce the enabled state.

Recommended State Rationale: 
- Basic: 'Enabled' is the minimum acceptable security posture. It is the default configuration for Windows and is recommended by all major security frameworks (e.g., CIS Benchmarks). 
- Moderate & Strict: For this specific binary setting, there is no more secure state than 'Enabled'. It is a fundamental security control. Therefore, 'Enabled' is the only appropriate recommendation for all security levels. Disabling this feature is considered a high-risk configuration and is strongly discouraged in any environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'EnableLUA' at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script should output 'Enabled' if the value data is 1, and 'Disabled' if it is 0. If the value does not exist, it should return 'Enabled' as this is the system default. The script must only return the resulting string and no other text.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument: 'Enabled' or 'Disabled'. The script must configure the 'User Account Control: Run all administrators in Admin Approval Mode' setting by setting the registry value 'EnableLUA' (as a DWORD type) at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to 1 for 'Enabled' or 0 for 'Disabled'. The script must return $true upon successful modification and $false if it fails or the input is invalid.

