# Ensure 'User Account Control: Behaviour of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for consent on the secure desktop' or higher

Necessity: This setting governs the behavior of the User Account Control (UAC) elevation prompt for administrators. Its primary purpose is to mitigate the impact of malware by preventing unauthorized privilege elevation. A properly configured prompt ensures that administrative tasks require explicit user approval, preventing malicious code from silently gaining system-wide control. Using the 'secure desktop' is critical as it isolates the prompt from the user's session, protecting against user interface (UI) spoofing and input injection attacks where malware could simulate clicks or steal credentials. Misconfiguration can effectively disable UAC, creating a significant security vulnerability. Auditing and Remediation: The audit script reads the specific registry DWORD value 'ConsentPromptBehaviorAdmin' which dictates the prompt's behavior. The remediation script directly modifies this value to align with the desired security policy, accepting a numerical input corresponding to a specific UAC behavior. Recommended State Rationale: Basic & Moderate: The recommended state is '2' ('Prompt for consent on the secure desktop'). This is the standard best practice recommended by CIS benchmarks, providing a strong security posture by requiring explicit consent on the protected secure desktop. It effectively balances security with user convenience for most environments. Strict: The recommended state is '1' ('Prompt for credentials on the secure desktop'). This is the most secure configuration. It forces the administrator to re-authenticate by entering their password for every elevation request. This mitigates the risk of an attacker gaining control of an already logged-in administrator session and elevating privileges, making it ideal for high-security or shared administrative environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['2']` |
| **Moderate** | `['2']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'ConsentPromptBehaviorAdmin' at the path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script must output only the numerical data of this value. If the value does not exist, the script should return the system default of '5'.

## Remediation Script Working

PowerShell script that accepts a single positional integer argument. The script must set the DWORD registry value 'ConsentPromptBehaviorAdmin' at the path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to the value of the provided argument. The script must return '$true' if the operation is successful and '$false' otherwise.

