Examkin

Question

Difficulty: HardWindows Security Settings and User Account Control

A desktop technician is configuring Local Security Policy (secpol.msc) on a workstation running Windows 11 Pro in a shared lab environment. Management mandates that whenever a standard user account attempts an action requiring administrative privileges, Windows must automatically reject the elevation request without displaying a credential prompt. However, administrative users must retain the standard behavior of receiving a consent prompt on the Secure Desktop. Which Local Security Policy setting should the technician configure to meet the requirement for standard user accounts?

  1. Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'Answer
  2. B
    Set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'
  3. C
    Open User Account Control Settings in Control Panel and move the slider to 'Never notify'
  4. D
    Modify the local NTFS permissions on system executable files to deny Read & Execute access to the Standard Users group

Answer

Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'
The Local Security Policy setting 'User Account Control: Behavior of the elevation prompt for standard users' specifies how Windows handles privilege elevation requests initiated by standard user accounts. Setting this policy to 'Automatically deny elevation requests' prevents standard users from receiving a credential prompt when attempting administrative tasks, returning an access denied message immediately while leaving administrator prompt behaviors untouched.

Step-by-Step Solution

1
Identify the target user role and desired User Account Control (UAC) behavior
Standard users must have elevation requests automatically denied without seeing a credential prompt, while administrators keep consent prompts.
UAC policies distinguish between administrative accounts and standard user accounts.
2
Navigate to Local Security Policy (secpol.msc) under Security Settings > Local Policies > Security Options
Locate the granular UAC administrative policies.
Detailed UAC prompt behaviors for specific user account types are managed via Local Security Policy in Windows Pro/Enterprise editions.
3
Select the policy controlling standard user elevation prompt behavior
Configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
This policy specifically forces Windows to return an access denied error whenever a standard user triggers an operation requiring elevation.

Key Concept

Windows Local Security Policy UAC Elevation Settings
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic