A network administrator is hardening Windows 11 Enterprise desktop images for a public library computer lab. The organization's security policy mandates two strict requirements: standard user accounts must be blocked from initiating any privilege elevation requests (preventing credential prompt pop-ups), and local administrators performing maintenance must receive a consent prompt on an isolated screen before executing elevated tasks. Which TWO policy settings under Local Security Policy (`secpol.msc`) should the administrator configure to satisfy these security requirements?
- User Account Control: Behavior of the elevation prompt for standard users — Automatically deny elevation requestsAnswer
- User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode — Prompt for consent on the secure desktopAnswer
- CUser Account Control: Switch to the secure desktop when prompting for elevation — Disabled
- DUser Account Control: Run all administrators in Admin Approval Mode — Disabled
Answer
The administrator should configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' and 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for consent on the secure desktop'.
Configuring 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' ensures that standard users cannot invoke elevation prompts or attempt credential entry. Configuring 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for consent on the secure desktop' forces administrators to confirm elevation on an isolated desktop, satisfying both security requirements.
Step-by-Step Solution
Key Concept
Windows Local Security Policy (secpol.msc) User Account Control Elevation Behaviors