5

Does enabling UAC and setting the Admin approval behavior to Elevate without prompting provide any form of extra security to Administrator account. Note that my use case is for a Kiosk application where user interaction in Admin mode is very less.

  • 5
    UAC is not a security boundary under the best of scenarios, so it provides no significant enhancements to security. – Steve Nov 15 '17 at 18:30
  • +1 @Steve UAC is more a big-red "warning you are about to f*ck with this" button. It doesn't technically prevent any attack, except the social/phishing aspect. However, given that UAC in high mode can be quite irritating, alike all 'irritating security warnings' it may very well just be clicked-through, especially given the user will likely already have downloaded/interacted beforehand. So it can provide extra security, but it could weaken it by becoming an annoyance and removing consequence from action (de-sensitising your users). As steve said it's merely a warning - sweet f/a more. – Reality Jul 20 at 0:47
0

It is a bad idea, if you checkout the documentation here

Elevate without prompting. Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials.

note: Use this option only in the most constrained environments.

This is just notify the administrator execution attempts, it doesn't stop the program from execution. It is worst than the basic UAC that prompt for user consent.

0

UAC was implemented as a way to control who installed software on a device and not really as a security measure. It's more of a management solution than a security solution.

WRT the Administrator account: that should be used only sparingly. A more secure solution to that would be to rename the account and then disable it, then create other Administrator-level accounts for specific users.

0

I would recommend setting the UAC setting to maximum despite the fact that Microsoft does not treat it as a security boundary as this can often prevent privilege escalation from administrator to system privileges. However, if this isn't a concern, I can't imagine why you would ask an infosec forum this question at all.

0

User Account Control is disabled on the built-in Administrator account (this is not the same as elevate without prompt) by default. As such, it would not provide its features

If you turn on Admin Approval Mode for the built-in Administrator account, then it will provide its features.

Please remember, User Account Control is not a security boundary, and one should not solely rely on it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.