An IT security technician is implementing a hardened security baseline on Windows 11 Pro workstations for a finance company. The compliance policy mandates two specific behaviors: local administrators must be required to explicitly approve administrative privileges on an isolated secure desktop, and standard users must be completely restricted from seeing credential elevation prompts when attempting administrative operations. Which TWO configuration actions in the Local Security Policy snap-in (secpol.msc) under Security Options should be implemented to fulfill these requirements? (Select TWO.)
- Configure "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for consent on the secure desktop".Answer
- Configure "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests".Answer
- CModify the local file share and NTFS permissions on C:\Windows\System32 to revoke Read & Execute rights for the Builtin\Users group.
- DDeploy these exact Local Security Policy snap-in rules across non-managed Windows 11 Home edition computers.
Answer
The correct configurations are setting administrator prompt behavior to prompt for consent on the secure desktop and setting standard user elevation requests to automatically deny.
The combination of prompting for consent on the secure desktop for administrators and automatically denying elevation requests for standard users directly satisfies both audit requirements using Windows Local Security Policy settings.
Step-by-Step Solution
Key Concept
Windows User Account Control (UAC) Local Security Policies