UCF STIG Viewer Logo

UAC - Application Elevations


Overview

Finding ID Version Rule ID IA Controls Severity
V-16008 3.140 SV-16960r1_rule Medium
Description
This check verifies that Windows elevates all applications, not just signed ones.
STIG Date
Windows 2008 Domain Controller Security Technical Implementation Guide 2019-06-18

Details

Check Text ( C-32853r1_chk )
Analyze the system using the Security Configuration and Analysis snap-in.
Expand the Security Configuration and Analysis tree view.
Navigate to Local Policies -> Security Options.

If the value for “User Account Control: Only elevate executables that are signed and validated” is not set to “Disabled”, then this is a finding.

The policy referenced configures the following registry value:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\

Value Name: ValidateAdminCodeSignatures

Value Type: REG_DWORD
Value: 0
Fix Text (F-28963r1_fix)
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “User Account Control: Only elevate executables that are signed and validated” to “Disabled”.