Question

Difficulty: MediumWindows Security Settings and User Account Control

A network administrator is hardening Windows 11 Enterprise desktop images for a public library computer lab. The organization's security policy mandates two strict requirements: standard user accounts must be blocked from initiating any privilege elevation requests (preventing credential prompt pop-ups), and local administrators performing maintenance must receive a consent prompt on an isolated screen before executing elevated tasks. Which TWO policy settings under Local Security Policy (`secpol.msc`) should the administrator configure to satisfy these security requirements?

  1. User Account Control: Behavior of the elevation prompt for standard users — Automatically deny elevation requestsAnswer
  2. User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode — Prompt for consent on the secure desktopAnswer
  3. C
    User Account Control: Switch to the secure desktop when prompting for elevation — Disabled
  4. D
    User Account Control: Run all administrators in Admin Approval Mode — Disabled

Answer

The administrator should configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' and 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for consent on the secure desktop'.
Configuring 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' ensures that standard users cannot invoke elevation prompts or attempt credential entry. Configuring 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for consent on the secure desktop' forces administrators to confirm elevation on an isolated desktop, satisfying both security requirements.

Step-by-Step Solution

1
Identify the standard user security requirement
Standard users must not be able to elevate or view credential prompts.
Setting the policy 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' fulfills this by instantly blocking administrative elevation attempts from non-admin accounts.
2
Identify the administrative elevation security requirement
Administrators must confirm actions via a consent prompt on an isolated screen.
Setting 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for consent on the secure desktop' ensures administrators are prompted to allow execution on the secure desktop without needing to enter password credentials.

Key Concept

Windows Local Security Policy (secpol.msc) User Account Control Elevation Behaviors
Rate this question