Windows registry artifactUser Account Control (UAC)

Run all administrators in Admin Approval Mode - Disables UAC, 0 = Disabled (UAC Off), 1 = Enabled (UAC On)

  • Threat Hunting
  • 10 keys
  • SOFTWARE

Registry keys

10 keys that RECmd reads for this artifact

  • SOFTWAREEnableLUA
    Microsoft\Windows\CurrentVersion\Policies\System

    Run all administrators in Admin Approval Mode - Disables UAC, 0 = Disabled (UAC Off), 1 = Enabled (UAC On)

  • SOFTWAREConsentPromptBehaviorAdmin
    Microsoft\Windows\CurrentVersion\Policies\System

    Behavior of the elevation prompt for administrators in Admin Approval Mode - Disables UAC, 0 = Disabled (UAC Off), 1 = Prompt for credentials (Secure Desktop), 2 = Prompt for Consent Yes No (Secure Desktop), 3 = Prompt for credentials (Secure Desktop Off), 4 = Prompt for Consent Yes No (Secure Desktop Off), 5 = Prompt for Non-Windows Binaries (Default)

  • SOFTWAREConsentPromptBehaviorUser
    Microsoft\Windows\CurrentVersion\Policies\System

    Behavior of the elevation prompt for standard users, 0 = Deny Elevation Requests, 1 = Prompt for credentials (Secure Desktop - Default), 3 = Prompt for credentials (Secure Desktop Off)

  • SOFTWAREFilterAdministratorToken
    Microsoft\Windows\CurrentVersion\Policies\System

    Use Admin Approval Mode for the built-in Administrator account, 0 = Disabled (UAC Off - Default), 1 = Enabled (UAC On)

  • SOFTWAREEnableUIADesktopToggle
    Microsoft\Windows\CurrentVersion\Policies\System

    Allow UIAccess applications to prompt for elevation without using the secure desktop, 0 = Disabled (Secure Desktop On - Default), 1 = Enabled (Secure Desktop Off)

  • SOFTWAREEnableInstallerDetection
    Microsoft\Windows\CurrentVersion\Policies\System

    Detect application installations and prompt for elevation, 0 = Disabled (No Prompt), 1 = Enabled (Prompt)

  • SOFTWAREValidateAdminCodeSignatures
    Microsoft\Windows\CurrentVersion\Policies\System

    Only elevate executable files that are signed and validated, 0 = Disabled (Default), 1 = Enabled (Force PKI certification path validation)

  • SOFTWAREEnableSecureUIAPaths
    Microsoft\Windows\CurrentVersion\Policies\System

    Only elevate UIAccess applications that are installed in secure locations, 0 = Disabled (User Interface Accessibility Integrity Level in Insecure Locations Allowed), 1 = Enabled (Default)

  • SOFTWAREPromptOnSecureDesktop
    Microsoft\Windows\CurrentVersion\Policies\System

    Switch to the secure desktop when prompting for elevation, 0 = Disabled (Secure Desktop Off), 1 = Enabled (Default)

  • SOFTWAREEnableVirtualization
    Microsoft\Windows\CurrentVersion\Policies\System

    Virtualize file and registry write failures to per-user locations, 0 = Disabled (Fail to Write Data), 1 = Enabled (Default)

References

12 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)