Check: WN12-SO-000079
Windows 2012 IAVM:
WN12-SO-000079
(in version v1 r30)
Title
User Account Control must automatically deny standard user requests for elevation. (Cat II impact)
Discussion
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation when requested by a standard user account.
Check Content
UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ConsentPromptBehaviorUser Value Type: REG_DWORD Value: 0
Fix Text
UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests".
Additional Identifiers
Rule ID:
Vulnerability ID: V-14236
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-002038 |
The organization requires users to reauthenticate upon organization-defined circumstances or situations requiring reauthentication. |
Controls
Number | Title |
---|---|
IA-11 |
Re-authentication |