User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

Information

User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

This security setting determines the behavior of the elevation prompt for administrators

The options are:

Prompt for consent: An operation that requires elevation of privilege will prompt the Consent Admin to select either Permit or Deny. If the Consent Admin selects Permit the operation will continue with their highest available privilege. This option allows users to enter their name and password to perform a privileged task.

Prompt for credentials: An operation that requires elevation of privilege will prompt the Consent Admin to enter their user name and password. If the user enters valid credentials the operation will continue with the applicable privilege.

Elevate without prompting: This option allows the Consent Admin to perform an operation that requires elevation without consent or credentials. Note: this scenario should only be used in the most constrained environments.

Default: Prompt for consent

Solution

Policy Path: Security Options
Policy Setting Name: User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

See Also

https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-version-22h2-security-baseline/ba-p/3632520

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(1)

Plugin: Windows

Control ID: 0d8d3698b742e8f594e158d19b374c0ec6381badbeea154c9e18c996dc4632ed