# Ensure 'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled'

Necessity: This setting is a critical component of User Account Control (UAC) that helps prevent unauthorized software installation. When enabled, it detects application installation packages (e.g., .msi, .exe installers) that require elevated privileges to run. UAC then prompts the user for administrative credentials before allowing the installation to proceed. Disabling this feature would allow standard users to attempt installations that could lead to malware infection, system instability, or unauthorized system changes, thereby bypassing a key security layer. The risk of misconfiguration is a significantly increased attack surface for malware and privilege escalation attacks.

Auditing and Remediation: The audit script checks the 'EnableInstallerDetection' DWORD value in the Windows Registry to determine if this UAC feature is active. A value of 1 corresponds to 'Enabled'. The remediation script directly modifies this registry value, setting it to 1 to enable the feature or 0 to disable it, thereby enforcing the desired security policy.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Enabled'. This is a foundational security control with no practical downside. There is no less-secure state that offers a functional benefit, so disabling it is never recommended in any security posture. CIS Benchmarks and Microsoft security baselines mandate this setting be enabled to ensure that all software installations are explicitly authorized by an administrator, effectively preventing a common vector for malware execution.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'EnableInstallerDetection' at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script should output 'Enabled' if the DWORD value is 1, and 'Disabled' if the value is 0 or does not exist. The output must exclusively contain the string 'Enabled' or 'Disabled'.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('Enabled' or 'Disabled'). The script must set the 'EnableInstallerDetection' DWORD value at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to 1 for 'Enabled' or 0 for 'Disabled'. If the specified registry path does not exist, the script must create it. The script must return $true on successful completion or $false if an error occurs.

