I'm the admin for a Windows 10 machine with a few local users. While I understand there are other ways to bypass security with access to the physical machine, I'd like to protect against hacks that bypass the UAC by running some trick of
RunAsInvoker, regedit, or folder renaming.
I've changed the User Notify session to
Always notify from
Notify me only when programs try to make changes to my computer, but I don't think this is enough.
I'm a bit surprised that local non-admin users can bypass the UAC so easily. The intent is to prevent users from installing additional software on the machine that would normally require UAC access (maybe I'm misunderstanding the point of a local user?).