User Account Control: Only elevate UIAccess applications that are installed in secure locations

Information

User Account Control: Only elevate UIAccess applications that are installed in secure locations

This security setting will enforce the requirement that applications that request execution with a UIAccess integrity level (via a marking of UIAccess=true in their application manifest), must reside in a secure location on the file system. Secure locations are limited to the following directories:

- \Program Files\, including subdirectories
- \Windows\system32\
- \Program Files (x86)\, including subdirectories for 64 bit versions of Windows

Note: Windows enforces a PKI signature check on any interactive application that requests execution with UIAccess integrity level regardless of the state of this security setting.

The options are:

Enabled: An application will only launch with UIAccess integrity if it resides in a secure location in the file system.

Disabled: An application will launch with UIAccess integrity even if it does not reside in a secure location in the file system.

Default: Enabled

Solution

Policy Path: Security Options
Policy Setting Name: User Account Control: Only elevate UIAccess applications that are installed in secure locations

See Also

https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-security-baseline/ba-p/2810772

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(8)

Plugin: Windows

Control ID: 8c7560b94aa718b88dabae16ab767cb77d277e38a4f4532ada01e0768a6be518