Enforce User Account Control

 You are the Security Analyst for a small corporate network. The company has a single Active Directory domain named CorpNet.xyz. You need to increase the domain's authentication security. You need to make sure that User Account Control (UAC) settings are consistent throughout the domain and in accordance with industry recommendations.

In this lab, your task is to configure the following UAC settings in the Default Domain Policy on CorpDC:

User Account ControlSetting
Admin Approval Mode for the Built-in Administrator accountEnabled
Allow UIAccess applications to prompt for elevation without using the secure desktopDisabled
Behavior of the elevation prompt for administrators in Admin Approval modePrompt for credentials
Behavior of the elevation prompt for standard usersAutomatically deny elevation requests
Detect application installations and prompt for elevationEnabled
Only elevate executables that are signed and validatedDisabled
Only elevate UIAccess applications that are installed in secure locationsEnabled
Run all administrators in Admin Approval ModeEnabled
Switch to the secure desktop when prompting for elevationEnabled
Virtualize file and registry write failures to per-user locationsEnabled


User Account Control policies are set in a GPO linked to the domain. In this scenario, edit the Default Domain Policy and configure settings in the following path:
Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.








EXPLANATION

While completing this lab, use the following UAC settings for the Default Domain Policy on CorpDC:

User Account ControlSetting
Admin Approval Mode for the Built-in Administrator accountEnabled
Allow UIAccess applications to prompt for elevation without using the secure desktopDisabled
Behavior of the elevation prompt for administrators in Admin Approval modePrompt for credentials
Behavior of the elevation prompt for standard usersAutomatically deny elevation requests
Detect application installations and prompt for elevationEnabled
Only elevate executables that are signed and validatedDisabled
Only elevate UIAccess applications that are installed in secure locationsEnabled
Run all administrators in Admin Approval ModeEnabled
Switch to the secure desktop when prompting for elevationEnabled
Virtualize file and registry write failures to per-user locationsEnabled
Only elevate UIAccess applications that are installed in secure locationsEnabled
Run all administrators in Admin Approval ModeEnabled
Switch to the secure desktop when prompting for elevationEnabled
Virtualize file and registry write failures to per-user locationsEnabled

Complete this lab as follows:

      1. Open Group Policy Management on CorpDC.
        1. From Hyper-V Manager, select CORPSERVER.
        2. Double-click CorpDC to open the virtual machine.
        3. From Server Manager, select Tools > Group Policy Management.
        4. Maximize the window for better viewing.
      2. Open the Default Domain Policy for editing.
        1. Expand Forest: CorpNet.local > Domains > CorpNet.local.>link group policy objects
        2. Right-click Default Domain Policy and select Edit.
        3. Maximize the window for easier viewing.
      3. In Security Options, edit the User Account Control policies .
        1. Under Computer Configuration, expand Policies.
        2. Expand Windows Settings > Security Settings > Local Policies.
        3. Select Security Options.
        4. In the right pane, right-click the policy you want to edit and select Properties.
        5. Select Define this policy setting.
        6. Select Enable or Disable as necessary.
        7. Edit the value for the policy as needed and then select OK.
        8. Repeat steps 3d–3g for each policy setting

    Comments

    Post a Comment

    Popular Posts