Question

Difficulty: HardWindows Security Settings and User Account Control

An IT security technician is implementing a hardened security baseline on Windows 11 Pro workstations for a finance company. The compliance policy mandates two specific behaviors: local administrators must be required to explicitly approve administrative privileges on an isolated secure desktop, and standard users must be completely restricted from seeing credential elevation prompts when attempting administrative operations. Which TWO configuration actions in the Local Security Policy snap-in (secpol.msc) under Security Options should be implemented to fulfill these requirements? (Select TWO.)

  1. Configure "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for consent on the secure desktop".Answer
  2. Configure "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests".Answer
  3. C
    Modify the local file share and NTFS permissions on C:\Windows\System32 to revoke Read & Execute rights for the Builtin\Users group.
  4. D
    Deploy these exact Local Security Policy snap-in rules across non-managed Windows 11 Home edition computers.

Answer

The correct configurations are setting administrator prompt behavior to prompt for consent on the secure desktop and setting standard user elevation requests to automatically deny.
The combination of prompting for consent on the secure desktop for administrators and automatically denying elevation requests for standard users directly satisfies both audit requirements using Windows Local Security Policy settings.

Step-by-Step Solution

1
Identify the Local Security Policy location
Navigate to Local Policies -> Security Options within secpol.msc on supported Windows Pro/Enterprise editions.
UAC elevation prompt policies are located centrally under Local Security Policy security options.
2
Configure Administrator Prompt Behavior
Set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for consent on the secure desktop'.
This satisfies the requirement for administrators to explicitly approve privilege requests on a secure dimming desktop.
3
Configure Standard User Elevation Policy
Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
This satisfies the requirement to suppress credential prompts for standard users, automatically rejecting unauthorized elevation attempts.

Key Concept

Windows User Account Control (UAC) Local Security Policies
Rate this question