Lesson 1: Configuring and Troubleshooting User Account Control

211

Quick Check

■

You want to ensure that standard users cannot perform tasks that require elevated

privileges and are not prompted for administrator credentials when they attempt

to carry out such tasks. What UAC setting should you configure?

Quick Check Answer

■ Set User Access Control: Behavior Of The Elevation Prompt For Standard Users to

Automatically Deny Elevation Requests.

Detect Application Installations and Prompt for Elevation

This setting determines whether signed and unsigned application installs trigger a UAC eleva-

tion dialog box. The setting affects the entire system, and the default on a Windows Vista Ulti-

mate client running in a workgroup is Enabled. The following options are available:

■

Enabled UAC detects application installation packages that require an elevation of priv-

ilege to install and triggers the relevant elevation prompt. The prompt depends upon

whether the user has logged on by using a standard or an administrator account and

whether the application is signed.

■ Disabled Typically, a domain administrator would disable this setting in an enterprise

environment with standard user desktops that leverage delegated installation technolo-

gies such as Group Policy Software Install (GPSI) or Systems Management Server (SMS).

In this case, installer detection is unnecessary.

MORE INFO GPSI and SMS

You can obtain more information about GPSI by accessing http://support.microsoft.com/default.aspx

/kb/816102 and about SMS by accessing http://www.microsoft.com/smserver/default.mspx. However,

these technologies are unlikely to be featured in the 70-620 examination.

Only Elevate Executables That Are Signed and Validated

This setting determines whether UAC enforces public key infrastructure (PKI) signature

checks on any interactive application that requests elevation of privilege. If such checking is

enforced, only signed application installs can trigger a UAC elevation dialog box and receive

permission to continue. The default setting for a PC running Windows Vista Ultimate in a

workgroup is Disabled. The following options are available:

■

Disabled

UAC does not enforce PKI certificate chain validation before an executable

can run. A user with elevated privileges can run unsigned executable files on the

computer.