How to Configure and Audit User Account Control (UAC) Elevation Prompts Using PowerShell in Windows 11

User Account Control (UAC) is a foundational security architecture introduced to prevent unauthorized system modifications and malware from silently inheriting elevated administrative tokens in Windows. Even when logged into Windows 11 with an administrative account, daily applications execute within a restricted standard user security context. When a process attempts to execute an action requiring high-integrity privileges—such as installing a driver, altering firewall rules, or modifying the system registry—UAC intercepts the request and generates an elevation prompt. In enterprise environments, relying on default UAC behaviors often leaves workstations vulnerable to credential spoofing, background bypasses, and clickjacking attacks. Mastering UAC policy configuration and registry auditing via Windows PowerShell allows systems engineers to enforce zero-trust endpoint privilege controls.

Understanding UAC Token Filtering and Integrity Levels

Windows 11 regulates process security through Mandatory Integrity Control (MIC) and split-token architecture:

• Split-Token Architecture: Upon user authentication, the Local Security Authority (LSA) creates two access tokens for an administrator: a filtered standard user token (used for everyday applications like web browsers and productivity software) and an elevated administrative token held in reserve.
• Integrity Levels: Processes operate across four primary integrity tiers: Low (sandboxed browsers), Medium (standard user apps), High (elevated administrative tools), and System (kernel services).
• Secure Desktop: When UAC requests confirmation or credentials, it switches the display subsystem to an isolated session (Session 0 desktop isolation). Standard user-mode malware cannot inject keystrokes, capture screenshots, or simulate mouse clicks on the Secure Desktop.

Auditing Active UAC Registry Parameters via PowerShell

All core User Account Control policies reside in the Windows Registry under HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System. You can inspect your active configuration directly within an elevated PowerShell console.

1. Click the Start button, type powershell, right-click Windows PowerShell, and select Run as administrator.
2. Query the primary UAC registry keys:

   Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-Object EnableLUA, ConsentPromptBehaviorAdmin, ConsentPromptBehaviorUser, PromptOnSecureDesktop, FilterAdministratorToken

3. Evaluate the returned values against enterprise security benchmarks:
   • EnableLUA: Must be set to 1. Setting this to 0 completely deactivates UAC system-wide, exposing the workstation to catastrophic compromise.
   • PromptOnSecureDesktop: Should equal 1 to enforce the isolated Secure Desktop dimming screen.
   • ConsentPromptBehaviorAdmin: Governs how administrative users are prompted.
   • ConsentPromptBehaviorUser: Governs how standard non-administrative accounts handle elevation requests.

Hardening UAC Elevation Prompts for Administrators

By default, Windows 11 prompts administrators with a simple “Yes/No” consent prompt (ConsentPromptBehaviorAdmin = 5). In high-security enterprise environments, hardening this policy to mandate explicit credential re-entry stops automated malware from exploiting session tokens.

Value	Behavior Name	Security Implications
0	Elevate without prompting	Insecure; bypasses all user confirmation.
1	Prompt for credentials on Secure Desktop	Highest security; requires entering password for every elevation.
2	Prompt for consent on Secure Desktop	Strict consent; requires clicking Yes on Secure Desktop.
5	Prompt for consent for non-Windows binaries	Default; silently elevates native Windows utilities.

To enforce credential entry for administrators on the Secure Desktop via PowerShell, execute:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 1

Restricting Elevation for Standard Non-Administrative Users

For managed workstations deployed to standard employees, standard practice mandates either prompting for administrative credentials or blocking elevation requests entirely.

• Prompt for Credentials (Default Enterprise):

  Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorUser" -Value 1

• Automatically Deny Elevation Requests:

  In tightly controlled environments where standard users should never elevate under any circumstances:

  Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorUser" -Value 0

  When set to 0, any attempt by a standard user to run an installer or administrative tool returns an immediate access-denied error without prompting for passwords.

Enforcing UAC Filtering on the Built-In Administrator Account

By default, the built-in local Administrator account (RID 500) bypasses UAC filtering entirely, executing all commands in Full Administrator mode. To enforce standard UAC token filtering on the built-in administrator account, activate FilterAdministratorToken:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "FilterAdministratorToken" -Value 1

Auditing UAC Elevation Events in the Windows Security Log

To detect lateral privilege escalation attempts or rogue elevation prompts, audit the Windows Security Log for Event ID 4673 (Privileged Service Called) and Event ID 4672 (Special Privileges Assigned to New Logon):

Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id = 4672
} -MaxEvents 5 | Format-List TimeCreated, Message

Configuring and enforcing UAC parameters via PowerShell establishes hardened endpoint privilege boundaries, neutralizing credential theft and unauthorized system tampering across Windows 11 environments.