The Windows Installer Always install with elevated privileges option must be disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34974	WN12-CC-000116	SV-52954r1_rule	ECLP-1	High

Description
Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.

STIG	Date
Windows Server 2012 / 2012 R2 Domain Controller Security Technical Implementation Guide	2014-07-09

Details

Check Text ( None )
None

Fix Text (F-45880r1_fix)
Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Always install with elevated privileges" to "Disabled".