A desktop support specialist is hardening standalone Windows 11 Pro workstations located in a public library environment. To satisfy new compliance mandates, the specialist must ensure that standard account users are completely blocked from attempting privilege elevation, and that administrative users must explicitly type their password on a isolated screen whenever an elevation request occurs. Which TWO of the following policy settings in Local Security Policy (secpol.msc) under Security Options should the specialist configure?
- Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'Cevap
- Set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'Cevap
- CSet 'User Account Control: Switch to the secure desktop when prompting for elevation' to 'Disabled'
- DSet 'User Account Control: Run all administrators in Admin Approval Mode' to 'Disabled'
Cevap
The technician must configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' and set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
Configuring 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' satisfies the requirement to prevent standard users from attempting privilege elevation. Setting 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop' ensures administrators must enter their full password on an isolated secure desktop screen before privilege elevation is granted.
Adım Adım Çözüm
Anahtar Kavram
Configuring Local Security Policy (secpol.msc) User Account Control security options for elevation prompt behaviors.