Check: WN11-CC-000315
Microsoft Windows 11 STIG:
WN11-CC-000315
(in versions v2 r2 through v1 r1)
Title
The Windows Installer feature "Always install with elevated privileges" must be disabled. (Cat I impact)
Discussion
Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.
Check Content
If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value Type: REG_DWORD Value: 0
Fix Text
Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Always install with elevated privileges" to "Disabled".
Additional Identifiers
Rule ID: SV-253411r1016439_rule
Vulnerability ID: V-253411
Group Title: SRG-OS-000362-GPOS-00149
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001782 |
The organization updates the information system component inventory per organization-defined frequency. |
| CCI-001812 |
The information system prohibits user installation of software without explicit privileged status. |
| CCI-003980 |
Allow user installation of software only with explicit privileged status. |