# Ensure 'User Account Control: Admin Approval Mode for the Built-in Administrator account' is set to 'Enabled'

Necessity: The built-in Administrator account has the highest level of privilege on a Windows system. By default, it runs all applications with full administrative rights without User Account Control (UAC) elevation prompts. This creates a significant security risk, as any malicious code executed by this account can compromise the entire system without warning. Enabling Admin Approval Mode for this account subjects it to the same UAC prompts as other administrators, enforcing the principle of least privilege and mitigating the risk of unintentional or malicious system-wide changes.

Auditing and Remediation: The audit script checks the 'FilterAdministratorToken' registry value, which directly corresponds to this policy setting. A value of '1' indicates it is enabled. The remediation script modifies this registry value to enforce the desired state, effectively enabling or disabling the UAC protection for the built-in Administrator account.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Enabled'. There is no secure configuration where this setting is disabled. Basic security requires this control to be active to protect against trivial privilege escalation. Moderate and Strict configurations mandate this setting as a foundational security measure. Disabling this feature effectively removes a critical defense-in-depth layer for the system's most powerful account, which is unacceptable in any security-conscious environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the value of 'FilterAdministratorToken' from the registry key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script must return only the current value, where '1' signifies 'Enabled' and '0' signifies 'Disabled'. If the value does not exist, the script should return '0'.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('1' for Enabled, '0' for Disabled). The script must configure the 'User Account Control: Admin Approval Mode for the Built-in Administrator account' setting by setting the 'FilterAdministratorToken' DWORD value at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to the provided argument. The script must return '$true' on success and '$false' on failure.

