# Ensure 'User Account Control: Behaviour of the elevation prompt for standard users' is set to 'Automatically deny elevation requests

Necessity: This setting governs how User Account Control (UAC) handles elevation requests initiated by standard users. Setting it to 'Automatically deny elevation requests' is a critical security control based on the principle of least privilege. It prevents standard users from running applications with administrative rights, which is a primary vector for malware execution, privilege escalation attacks, and unauthorized system changes. Misconfiguring this policy to allow prompts could enable a standard user to elevate privileges by tricking an administrator or using stolen credentials, thereby compromising the entire system.

Auditing and Remediation: The audit script checks the current configuration by reading the 'ConsentPromptBehaviorUser' DWORD value from the Windows Registry. The remediation script directly modifies this registry value to enforce the desired state, ensuring that elevation requests from standard users are denied by default.

Recommended State Rationale: 
- Basic: ['0'] (Automatically deny elevation requests)
- Moderate: ['0'] (Automatically deny elevation requests)
- Strict: ['0'] (Automatically deny elevation requests)
The recommended state for all levels of hardening is '0' because it is the only configuration that strictly enforces the separation between standard user and administrative privileges. The other available options ('Prompt for credentials' or 'Prompt for credentials on the secure desktop') introduce a significant risk by creating an opportunity for social engineering or credential theft. For a secure environment, any action requiring administrative rights should be performed by an administrator logging into a dedicated administrative session, not by elevating a standard user's session.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' for the 'ConsentPromptBehaviorUser' value. The script must output only the numerical value of this setting. If the value does not exist, it should default to '3'.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument representing the desired state for 'User Account Control: Behaviour of the elevation prompt for standard users'. The script should modify the 'ConsentPromptBehaviorUser' DWORD value in the registry key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to the provided argument. The script must create the value if it does not exist. It must return '$true' upon successful modification and '$false' if it fails.

