Examkin

Question

Difficulty: HardWindows Security Settings and User Account Control

A security administrator needs to harden a standalone Windows 11 Pro system by enforcing credential prompts on the Secure Desktop for administrative elevations and enabling Admin Approval Mode for the local Built-in Administrator account using administrative tools. In what correct sequential order should the technician execute these administrative steps from start to finish?

  1. 1Open the Run dialog box or an elevated prompt and execute secpol.msc to launch the Local Security Policy snap-in.
  2. 2Navigate to Security Settings > Local Policies > Security Options in the left navigation pane.
  3. 3Locate and configure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
  4. 4Locate and configure 'User Account Control: Admin Approval Mode for the Built-in Administrator account' to 'Enabled'.
  5. 5Open an elevated Command Prompt and execute gpupdate /force to immediately refresh local policy settings.

Answer

The correct sequence starts by opening secpol.msc, navigating to Security Settings > Local Policies > Security Options, setting the administrator elevation behavior to prompt for credentials on the secure desktop, enabling Admin Approval Mode for the Built-in Administrator account, and finally executing gpupdate /force to apply the changes.
The standard procedure for hardening local security policy settings requires opening the snap-in console (secpol.msc), navigating to Security Settings > Local Policies > Security Options, configuring the target UAC prompt and Admin Approval policies, and executing gpupdate /force to force policy enforcement.

Step-by-Step Solution

1
Launch the management console using secpol.msc.
The Local Security Policy console window opens.
Administrative security options for UAC are managed within the Local Security Policy snap-in on Windows 11 Pro.
2
Navigate to Security Settings > Local Policies > Security Options.
The detailed list of system security options and UAC policies becomes visible.
UAC policies are organized under the Security Options subfolder within Local Policies.
3
Set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
Administrative actions trigger a credential prompt on an isolated desktop screen.
This prevents automated software or malware from spoofing user input or bypassing elevation controls.
4
Set 'User Account Control: Admin Approval Mode for the Built-in Administrator account' to 'Enabled'.
The built-in Administrator account must respond to UAC prompts for administrative privilege elevation.
By default, the built-in Administrator account bypasses UAC unless explicit Admin Approval Mode policy is enabled.
5
Run gpupdate /force from an elevated Command Prompt.
Local security policy changes take effect immediately.
Forces an immediate refresh of local policy configurations without waiting for default background refresh intervals.

Key Concept

Windows Local Security Policy (secpol.msc) and UAC Admin Approval Mode configuration
Estimated Time:2m 0s
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic