User Account Control: Only elevate UIAccess applications that are installed in secure locations

Information

User Account Control: Only elevate UIAccess applications that are installed in secure locations

This security setting will enforce the requirement that applications that request execution with a UIAccess integrity level (via a marking of UIAccess=true in their application manifest), must reside in a secure location on the file system. Secure locations are limited to the following directories:

- \Program Files\, including subdirectories
- \Windows\system32\
- \Program Files (x86)\, including subdirectories for 64 bit versions of Windows

Note: Windows enforces a PKI signature check on any interactive application that requests execution with UIAccess integrity level regardless of the state of this security setting.

The options are:

Enabled: An application will only launch with UIAccess integrity if it resides in a secure location in the file system.

Disabled: An application will launch with UIAccess integrity even if it does not reside in a secure location in the file system.

Default: Enabled

Solution

Policy Path: Security Options
Policy Setting Name: User Account Control: Only elevate UIAccess applications that are installed in secure locations

See Also

https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-version-22h2-security-baseline/ba-p/3632520

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(8)

Plugin: Windows

Control ID: f8bf5c1c674e2ec24af75787bab53b61c9d1abac9c5dec913a23d1142b9b7fbf