# Ensure 'User Account Control: Admin Approval Mode for the Built-in Administrator account' is set to 'Enabled'

Necessity: The built-in Administrator account is a high-value target for attackers. By default, it operates with full administrative privileges and bypasses User Account Control (UAC) prompts. This means any application or script run by this account, malicious or otherwise, gains immediate, unrestricted system access. Enabling 'Admin Approval Mode' subjects the built-in Administrator account to the same UAC elevation prompts as other administrators, providing a critical security barrier against unintended system changes and privilege escalation. Disabling this setting leaves a significant security vulnerability by allowing malware to execute with the highest privileges without user interaction. Auditing and Remediation: The audit script checks the status of the 'FilterAdministratorToken' registry value, which directly controls this policy. The remediation script modifies this same registry value, setting it to '1' to enable the policy or '0' to disable it. Recommended State Rationale: For this specific binary control, 'Enabled' is the only secure state. Therefore, it is the recommendation for all security levels. Basic: Setting the state to 'Enabled' is the minimum requirement for a hardened system, aligning with security benchmarks like CIS. It enforces the principle of least privilege even for the most powerful default account. Moderate: The recommendation remains 'Enabled' as there is no middle ground for this setting. Any configuration other than 'Enabled' is considered insecure. Strict: For a strictly hardened system, it is imperative that this control is 'Enabled' to ensure the built-in Administrator account is not exempt from UAC, thereby minimizing its attack surface.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'FilterAdministratorToken' at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. If the value is '1', the script must return 'Enabled'. If the value is '0' or does not exist, it must return 'Disabled'. The script must not output any other text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('Enabled' or 'Disabled'). If the argument is 'Enabled', the script must set the registry value 'FilterAdministratorToken' (DWORD) at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to '1'. If the argument is 'Disabled', it must set the value to '0'. The script must return '$true' upon successful modification and '$false' if the input is invalid or an error occurs.

