Examkin

Question

Difficulty: Very hardWindows Security Settings and User Account Control

A security administrator is hardening a standalone Windows 11 workstation. The organization requires that administrators must re-enter credentials on a secure desktop when elevating privileges, standard users must be automatically denied elevation without a prompt, and the changes must take effect immediately without a reboot. Arrange the following administrative steps in the correct logical sequence to accomplish this configuration.

  1. 1Open the Local Security Policy management console (secpol.msc) with elevated privileges.
  2. 2Navigate to Security Settings > Local Policies > Security Options in the console tree.
  3. 3Modify 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
  4. 4Modify 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
  5. 5Execute gpupdate /force in an elevated Command Prompt to apply the policy changes immediately.

Answer

The correct sequence is: Open the Local Security Policy console (secpol.msc) with elevated privileges, navigate to Security Settings > Local Policies > Security Options, configure the administrator elevation prompt behavior to prompt for credentials on the secure desktop, configure the standard user elevation prompt behavior to automatically deny elevation requests, and execute gpupdate /force from an elevated Command Prompt.
To achieve granular security control over UAC prompt behaviors, the administrator must first open secpol.msc with administrative privileges and navigate to Security Settings > Local Policies > Security Options. Next, the administrator configures the prompt behavior for administrators to require credentials on the secure desktop. Then, the prompt behavior for standard users is set to automatically deny elevation requests. Finally, running gpupdate /force in an elevated Command Prompt forces the operating system to re-read and enforce the local security baseline immediately without restarting.

Step-by-Step Solution

1
Launch Local Security Policy console
The Local Security Policy snap-in (secpol.msc) opens with full administrative access.
Administrative rights are required to view and modify security settings across the system.
2
Locate UAC policy settings
Expand Security Settings > Local Policies > Security Options in the navigation pane.
User Account Control behavior policies are maintained specifically under the Security Options subfolder.
3
Set Administrator UAC prompt behavior
Set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
This satisfies the explicit requirement for administrative users to re-enter credentials on a secure desktop during privilege elevation.
4
Set Standard User UAC prompt behavior
Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
This satisfies the requirement to suppress credentials prompts and automatically reject elevation requests initiated by non-admin accounts.
5
Apply policy updates without rebooting
Execute gpupdate /force in an elevated Command Prompt window.
This forces the operating system to immediately update and enforce local policy changes without restarting the workstation.

Key Concept

Windows Local Security Policy (secpol.msc) User Account Control Policy Hardening
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic