addressed feedback
@ -21462,22 +21462,22 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/identity-protection/user-account-control/how-user-account-control-works.md",
|
||||
"redirect_url": "windows/security/application-security/application-control/user-account-control/how-user-account-control-works",
|
||||
"redirect_url": "/windows/security/application-security/application-control/user-account-control/how-user-account-control-works",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md",
|
||||
"redirect_url": "windows/security/application-security/application-control/user-account-control/settings-and-configuration",
|
||||
"redirect_url": "/windows/security/application-security/application-control/user-account-control/settings-and-configuration",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md",
|
||||
"redirect_url": "windows/security/application-security/application-control/user-account-control/settings-and-configuration",
|
||||
"redirect_url": "/windows/security/application-security/application-control/user-account-control/settings-and-configuration",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/identity-protection/user-account-control/user-account-control-overview.md",
|
||||
"redirect_url": "windows/security/application-security/application-control/user-account-control",
|
||||
"redirect_url": "/windows/security/application-security/application-control/user-account-control",
|
||||
"redirect_document_id": false
|
||||
}
|
||||
]
|
||||
|
@ -29,7 +29,7 @@ To better understand how this process works, let's take a closer look at the Win
|
||||
|
||||
The following diagram shows how the sign in process for an administrator differs from the sign in process for a standard user.
|
||||
|
||||

|
||||
:::image type="content" source="images/uac-windows-logon-process.gif" alt-text="UAC Windows logon process diagram.":::
|
||||
|
||||
By default, both standard and administrator users access resources and execute apps in the security context of a standard user.\
|
||||
When a user signs in, the system creates an access token for that user. The access token contains information about the level of access that the user is granted, including specific security identifiers (SIDs) and Windows privileges.
|
||||
@ -56,13 +56,13 @@ The default, built-in UAC elevation component for an administrator account in Ad
|
||||
|
||||
The credential prompt is presented when a standard user attempts to perform a task that requires a user's administrative access token. Administrators can also be required to provide their credentials by setting the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting value to **Prompt for credentials**.
|
||||
|
||||
:::image type="content" source="images/uaccredentialprompt.png" alt-text="UAC credential prompt.":::
|
||||
:::image type="content" source="images/uac-credential-prompt.png" alt-text="Screenshot showing the UAC credential prompt.":::
|
||||
|
||||
### The consent prompt
|
||||
|
||||
The consent prompt is presented when a user attempts to perform a task that requires a user's administrative access token.
|
||||
|
||||
:::image type="content" source="images/uacconsentpromptadmin.png" alt-text="UAC consent prompt.":::
|
||||
:::image type="content" source="images/uac-consent-prompt-admin.png" alt-text="Screenshot showing the UAC consent prompt.":::
|
||||
|
||||
### UAC elevation prompts
|
||||
|
||||
@ -75,15 +75,15 @@ The UAC elevation prompts are color-coded to be app-specific, enabling for easie
|
||||
The elevation prompt color-coding is as follows:
|
||||
|
||||
- Gray background: The application is a Windows administrative app, such as a Control Panel item, or an application signed by a verified publisher
|
||||
:::image type="content" source="images/uaccredentialpromptsigned.png" alt-text="UAC credential prompt with a signed executable.":::
|
||||
:::image type="content" source="images/uac-credential-prompt-signed.png" alt-text="Screenshot showing the UAC credential prompt with a signed executable.":::
|
||||
- Yellow background: the application is unsigned or signed but isn't trusted
|
||||
:::image type="content" source="images/uaccredentialpromptunsigned.png" alt-text="UAC consent prompt with an unsigned executable.":::
|
||||
:::image type="content" source="images/uacc-redential-prompt-unsigned.png" alt-text="Screenshot showing the UAC consent prompt with an unsigned executable.":::
|
||||
|
||||
### Shield icon
|
||||
|
||||
Some Control Panel items, such as **Date and Time**, contain a combination of administrator and standard user operations. Standard users can view the clock and change the time zone, but a full administrator access token is required to change the local system time. The following is a screenshot of the **Date and Time** Control Panel item.
|
||||
|
||||
:::image type="content" source="images/uacshieldicon.png" alt-text="UAC Shield Icon in Date and Time Properties" border="false":::
|
||||
:::image type="content" source="images/uac-shield-icon.png" alt-text="Screenshot showing the UAC Shield Icon in Date and Time Properties" border="false":::
|
||||
|
||||
The shield icon on the **Change date and time...** button indicates that the process requires a full administrator access token.
|
||||
|
||||
@ -101,7 +101,7 @@ While malware could present an imitation of the secure desktop, this issue can't
|
||||
|
||||
The following diagram details the UAC architecture.
|
||||
|
||||

|
||||
:::image type="content" source="images/uac-architecture.gif" alt-text="UAC architecture diagram.":::
|
||||
|
||||
To better understand each component, review the following tables:
|
||||
|
||||
|
Before Width: | Height: | Size: 25 KiB After Width: | Height: | Size: 25 KiB |
Before Width: | Height: | Size: 375 KiB After Width: | Height: | Size: 375 KiB |
Before Width: | Height: | Size: 306 KiB After Width: | Height: | Size: 306 KiB |
Before Width: | Height: | Size: 299 KiB After Width: | Height: | Size: 299 KiB |
Before Width: | Height: | Size: 310 KiB After Width: | Height: | Size: 310 KiB |
Before Width: | Height: | Size: 192 KiB After Width: | Height: | Size: 192 KiB |
Before Width: | Height: | Size: 73 KiB After Width: | Height: | Size: 73 KiB |
Before Width: | Height: | Size: 8.1 KiB After Width: | Height: | Size: 8.1 KiB |
@ -24,7 +24,7 @@ When a user tries to perform an action that requires administrative privileges,
|
||||
- If the user approves the change, the action is performed with the highest available privilege
|
||||
- If the user doesn't approve the change, the action isn't performed and the application that requested the change is prevented from running
|
||||
|
||||
:::image type="content" source="images/uacconsentpromptadmin.png" alt-text="UAC prompt in Windows 11.":::
|
||||
:::image type="content" source="images/uac-consent-prompt-admin.png" alt-text="Screenshot showing the UAC consent prompt.":::
|
||||
|
||||
When an app requires to run with more than standard user rights, UAC allows users to run apps with their *administrator token* (that is, with administrative rights and permissions) instead of their default, standard user token. Users continue to operate in the standard user security context, while enabling certain apps to run with elevated privileges, if needed.
|
||||
|
||||
|
@ -41,7 +41,7 @@ The following instructions provide details how to configure your devices. Select
|
||||
|
||||
To configure devices using Microsoft Intune, [create a **Settings catalog** policy][MEM-2], and use the settings listed under the category **`Local Policies Security Options`**:
|
||||
|
||||
:::image type="content" source="./images/settings-catalog-uac.png" alt-text="Screenshot that shows the UAC policies in the Intune settings catalog." lightbox="./images/settings-catalog-uac.png" border="True":::
|
||||
:::image type="content" source="./images/uac-settings-catalog.png" alt-text="Screenshot that shows the UAC policies in the Intune settings catalog." lightbox="./images/uac-settings-catalog.png" border="True":::
|
||||
|
||||
Assign the policy to a security group that contains as members the devices or users that you want to configure.
|
||||
|
||||
|