Advice Request Does this policy harden against UAC bypasses?

[ForgottenSeer 77194]

Generally standard user accounts have stronger mitigations from uac bypasses than admin accounts.
This policy ( User Account Control: Admin Approval Mode for the Built-in Administrator account ) from this site claims:
"When the Admin Approval Mode is enabled, the local administrator account functions like a standard user account, but it has the ability to elevate privileges without logging on by using a different account"

Does it treat local administrator account as standard user account? Can someone test for uac bypasses?

 

[ForgottenSeer 92963]

As far as I know, it enables UAC for the build-in administrator (which Vista had), meaning that processes run Medium Integrity Rights (like a Standard User), but when doing tasks requiring higher rights (admin rights) it will confirm to UAC settings of admin (by default showing UAC prompt). At that time (Vista) it was good practice to enable it. Windows 7 had the build-in admin account disabled by default.

 

[Andy Ful]

Generally standard user accounts have stronger mitigations from uac bypasses than admin accounts.
This policy ( User Account Control: Admin Approval Mode for the Built-in Administrator account ) from this site claims:
"When the Admin Approval Mode is enabled, the local administrator account functions like a standard user account, but it has the ability to elevate privileges without logging on by using a different account"

Does it treat local administrator account as standard user account? Can someone test for uac bypasses?

The short answer is No.
This works like Standard User Account but not exactly the same.

One of the risks that the UAC feature tries to mitigate is that of malicious software running under elevated credentials without the user or administrator being aware of its activity. An attack vector for malicious programs is to discover the password of the Administrator account because that user account was created for all installations of Windows. To address this risk, the built-in Administrator account is disabled in computers running at least Windows Vista.

Remark.
The built-in Administrator account is disabled by default (from Windows Vista) on the client machines. Microsoft decided to install by default the normal Administrator account which behaves similarly as the built-in Administrator account + Admin Approval Mode.

 

[ForgottenSeer 77194]

ok, Thanks.