# Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'

Necessity: This setting determines whether the User Account Control (UAC) elevation prompt is displayed on the secure desktop. The secure desktop isolates the prompt from the user's interactive desktop, preventing malware from spoofing the user interface or tampering with the prompt itself. Disabling this feature exposes the system to UI spoofing and shatter attacks, where malicious software could intercept user credentials or automatically approve elevation requests, leading to a full system compromise. Auditing and Remediation: The audit script verifies the current state by reading the 'PromptOnSecureDesktop' DWORD value from the system registry. A value of '1' indicates it is enabled, and '0' indicates it is disabled. The remediation script directly modifies this registry value to enforce the desired state. Recommended State Rationale: Because the protection offered by the secure desktop is a fundamental component of UAC's security model, 'Enabled' is the only recommended state. There is no meaningful gradation of security for this binary setting. Therefore, the Basic, Moderate, and Strict levels all recommend 'Enabled' to ensure the integrity of the elevation process, aligning with security best practices from organizations like CIS and Microsoft.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the value of the registry key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' for the property 'PromptOnSecureDesktop'. The script must return only the current value, which will be '1' for Enabled or '0' for Disabled, without any additional text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('1' for Enabled or '0' for Disabled). The script must set the value of 'PromptOnSecureDesktop' (as a DWORD type) in the registry key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The script must create the value if it does not exist and return '$true' on success or '$false' on failure.

