# Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'

Necessity: This setting is critical for protecting against user interface (UI) manipulation attacks. When a program requests elevation, User Account Control (UAC) switches the desktop to a secure, isolated environment. This 'secure desktop' can only be accessed by trusted system processes, preventing malware from spoofing the UAC prompt, clicking the 'Yes' button programmatically, or otherwise interfering with the user's decision. Disabling this feature allows malware running with standard user privileges to potentially bypass UAC and gain administrative access.

Auditing and Remediation: The audit script inspects the 'PromptOnSecureDesktop' registry value under 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to determine if the secure desktop feature is active. The remediation script modifies this same registry value, setting it to '1' to enable the feature or '0' to disable it, based on the provided argument.

Recommended State Rationale: The recommended state for all levels—Basic, Moderate, and Strict—is 'Enabled'. This is a foundational security feature with no performance trade-offs that would justify disabling it. There is no intermediate or 'more secure' state; it is either on (secure) or off (insecure). Therefore, any compliant security policy requires this setting to be enabled to protect the integrity of the administrative elevation process.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to check the 'User Account Control: Switch to the secure desktop when prompting for elevation' setting. The script must query the DWORD value 'PromptOnSecureDesktop' at the registry path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. If the value data is 1, or if the value does not exist (as the default is enabled), the script must output the string 'Enabled'. If the value data is 0, it must output 'Disabled'. The output must contain only the resulting string.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('Enabled' or 'Disabled') to configure the 'User Account Control: Switch to the secure desktop when prompting for elevation' setting. The script must set the DWORD value 'PromptOnSecureDesktop' at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. An input of 'Enabled' should set the value data to 1, and 'Disabled' to 0. The script must create the registry key or value if they do not exist. The script must return the boolean value $true on success and $false on failure.

