# Ensure 'User Account Control: Run all administrators in Admin Approval Mode' is set to 'Enabled'

Necessity: This setting is the core component of User Account Control (UAC). When enabled, it runs all accounts, including administrators, with a standard user access token. When an operation requires administrative privileges, UAC prompts the user for consent. This prevents malicious software from silently gaining elevated permissions and making system-wide changes, thereby mitigating the risk of privilege escalation attacks and unauthorized system modifications. Disabling this setting effectively turns off UAC for administrators, leaving the system highly vulnerable.

Auditing and Remediation: The audit script checks the status of the 'EnableLUA' registry value, which directly controls Admin Approval Mode. The remediation script modifies this same registry value to either 1 (Enabled) or 0 (Disabled) based on the input, thereby enforcing the desired security policy. A reboot is required for this change to take full effect.

Recommended State Rationale: 
- Basic: ['Enabled'] is the minimum and universally recommended state. It ensures the fundamental protection of UAC is active, which is a cornerstone of Windows security.
- Moderate: ['Enabled'] is also the moderate recommendation because this is a binary security control. There is no intermediate state; it is either protecting the system or it is not.
- Strict: ['Enabled'] remains the strict recommendation. Any secure configuration requires Admin Approval Mode to be active. Disabling it is contrary to all security hardening standards and best practices.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'EnableLUA' at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script must output the string 'Enabled' if the value data is 1, and 'Disabled' if the value data is 0 or the value does not exist. The output must consist solely of the resulting string.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument which must be either 'Enabled' or 'Disabled'. The script will map 'Enabled' to a DWORD value of 1 and 'Disabled' to 0, then set the 'EnableLUA' value at the registry path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. If the path or value does not exist, it must be created. The script must output '$true' on success and '$false' on failure or invalid input.

