# Ensure 'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled'

Necessity: This User Account Control (UAC) setting is critical for preventing unauthorized software installation. When enabled, it detects installation packages (e.g., .msi, .exe installers) that require elevated privileges to run. It then prompts the user for administrative credentials before allowing the installation to proceed. Disabling this feature creates a major security vulnerability, as it could allow malware or other unwanted applications to install silently without user consent, potentially leading to system compromise, data theft, or ransomware infection. 

Auditing and Remediation: The audit script inspects the 'EnableInstallerDetection' registry value to verify whether this UAC feature is active. The remediation script directly modifies this registry value to align the system with the desired security policy, either enabling or disabling the detection mechanism based on the input provided. 

Recommended State Rationale: 
- Basic: 'Enabled' is the minimum required state for a secure system. It ensures that all software installations are explicitly authorized by an administrator.
- Moderate: This setting remains at 'Enabled' as it is a foundational binary control. There is no intermediate state; it is either protecting the system or it is not.
- Strict: For the highest level of security, this setting must be 'Enabled'. It is a core component of the principle of least privilege, ensuring that installation processes do not run with elevated rights by default. Any deviation from 'Enabled' is considered a high-risk misconfiguration in all recognized security benchmarks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' for the DWORD 'EnableInstallerDetection'. The script must return the string 'Enabled' if the value is 1, and 'Disabled' if the value is 0 or does not exist. The output must exclusively be the current state string.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which must be either 'Enabled' or 'Disabled'. The script will configure the 'EnableInstallerDetection' DWORD value in the registry key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. If the argument is 'Enabled', the value should be set to 1; if 'Disabled', it should be set to 0. The script must return `$true` upon successful configuration and `$false` upon failure.

