# Ensure 'User Account Control: Behaviour of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for consent on the secure desktop' or higher

Necessity: This setting governs how User Account Control (UAC) prompts administrators for permission when a task requires elevated privileges. Using the 'secure desktop' is critical because it isolates the elevation prompt from the user's session, preventing malware from spoofing the prompt or intercepting user input. Misconfiguring this to a less secure option, especially 'Elevate without prompting', effectively bypasses UAC for administrators, allowing malware running with their permissions to gain full system control without any user interaction or warning, creating a significant security vulnerability.

Auditing and Remediation: The audit script checks the current configuration by reading the 'ConsentPromptBehaviorAdmin' registry value. The remediation script directly modifies this same registry value to enforce the desired UAC prompt behavior.

Recommended State Rationale:
- Basic: A value of '2' ('Prompt for consent on the secure desktop') is the minimum recommended state. It aligns with CIS benchmarks and ensures that an administrator must provide explicit consent in a protected environment before a process is elevated.
- Moderate: A value of '1' ('Prompt for credentials on the secure desktop') provides a higher level of security. It forces the administrator to re-enter their password, mitigating risks from attacks like session hijacking or malware that has compromised the user's access token but does not have their password.
- Strict: The strict recommendation is also '1'. This is the most secure option available for this setting, as it requires re-authentication for every elevation request, providing the strongest defense against unauthorized privilege escalation.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['2']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'ConsentPromptBehaviorAdmin' at the path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script must return only the current numerical value of this setting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument representing the desired state for the 'User Account Control: Behaviour of the elevation prompt for administrators in Admin Approval Mode' setting. The script must set the 'ConsentPromptBehaviorAdmin' REG_DWORD value at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to the provided argument. The script must return $true on successful modification and $false on failure.

