Examkin

Question

Difficulty: Very hardWindows Security Settings and User Account Control

A systems support technician is troubleshooting a legacy 32-bit line-of-business application installed on standalone Windows 11 Pro workstations. When standard domain users run the application, it crashes upon attempting to write log data to its installation directory under C:\Program Files (x86)\VendorApp. Running the application as an administrator allows it to function, but corporate security policy strictly prohibits granting local administrative rights or disabling User Account Control (UAC). Which policy under Local Security Policy (secpol.msc) should be enabled to resolve the application errors while adhering to security mandates?

  1. User Account Control: Virtualize file and registry write failures to per-user locationsAnswer
  2. B
    User Account Control: Behavior of the elevation prompt for standard users
  3. C
    User Account Control: Only elevate executables that are signed and validated
  4. D
    User Account Control: Switch to the secure desktop when prompting for elevation

Answer

Enable 'User Account Control: Virtualize file and registry write failures to per-user locations' in Local Security Policy.
Enabling 'User Account Control: Virtualize file and registry write failures to per-user locations' allows Windows to transparently redirect failed write operations targeted at protected system locations (such as Program Files or HKEY_LOCAL_MACHINE) to a per-user location (%LOCALAPPDATA%\VirtualStore). This resolves compatibility issues for legacy 32-bit software without violating security baselines or requiring administrative rights.

Step-by-Step Solution

1
Identify the root cause of the application crash.
Legacy 32-bit software designed before UAC often attempts to write runtime state or log files directly to its install directory within C:\Program Files (x86).
Standard user accounts lack write permissions to system directories, causing permission denied errors.
2
Evaluate technical and security constraints.
Granting administrator privileges or disabling UAC is explicitly forbidden by security policy.
Least privilege principles must be maintained while enabling legacy application compatibility.
3
Configure UAC file and registry virtualization via Local Security Policy (secpol.msc).
Enabling 'User Account Control: Virtualize file and registry write failures to per-user locations' redirects unprivileged write operations to %LOCALAPPDATA%\VirtualStore.
Virtualization provides transparent backward compatibility for 32-bit legacy applications without altering NTFS permissions or granting administrative rights.

Key Concept

UAC File and Registry Virtualization
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic