EnableLUA: How to Fix ‘Run All Administrators in Admin Approval Mode’ (CIS 2.3.17.6)

EnableLUA is the registry value behind the CIS check “User Account Control: Run all administrators in Admin Approval Mode”. When it is 0, UAC is off and every administrator runs programs with a full admin token. Fix it by setting EnableLUA to 1 (Group Policy, registry or Intune) and restarting the computer.

What the scanner is actually detecting

This is a configuration audit, not a missing patch. The scanner reads one DWORD, EnableLUA, under HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem and expects it to be 1.

Microsoft describes this policy as the one that turns UAC on or off. Enabled is the default on clients, member servers, standalone servers and domain controllers, so a 0 was almost always set on purpose. When the policy is Disabled, Microsoft states that Admin Approval Mode and all related UAC policy settings are disabled, and Windows Security warns that the overall security of the operating system has been reduced.

That has a side effect worth knowing: the neighboring CIS items in section 2.3.17 (ConsentPromptBehaviorAdmin, FilterAdministratorToken, PromptOnSecureDesktop) can all show PASSED on a host where EnableLUA is 0, even though none of them is in force.

Real-world risk

With UAC on, an administrator’s session runs with a standard user token (medium integrity), and anything that needs the admin token has to go through an elevation prompt. With EnableLUA = 0, that split disappears:

• Every program an administrator starts, including a malicious attachment or download, runs with full administrative rights immediately, with no prompt.
• Local administrator accounts get full admin rights over the network. Tenable’s own documentation lists disabling UAC as one way to let a local account run credentialed audits, which tells you what an attacker holding a local admin password or hash gets too.

The limits, stated honestly:

• It is not remotely exploitable on its own. An attacker first needs code running in an admin’s session, or valid credentials.
• Standard user accounts are not affected; they never had an admin token to begin with.
• Microsoft classifies UAC as a defense-in-depth feature, not a security boundary, in its Windows security servicing criteria.

So treat it as removing a layer that makes admin sessions safer by default, not as an open door.

How to confirm it on the host

reg query "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem" /v EnableLUA

0x0 is the finding. 0x1 is compliant. To see the related UAC values at the same time:

Get-ItemProperty -Path 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem' |
    Select-Object EnableLUA, ConsentPromptBehaviorAdmin, PromptOnSecureDesktop, FilterAdministratorToken

The registry shows what will apply at the next boot, not necessarily what is running now. To check the live behavior, sign in with an administrator account (not the built-in Administrator), open a normal command prompt without “Run as administrator”, and run:

whoami /groups | findstr /i "Mandatory"

Medium Mandatory Level means UAC is filtering the token. High Mandatory Level in a non-elevated window means UAC is off. To find out whether a GPO is writing the 0, generate a report and look for the winning GPO under Security Options:

gpresult /h C:Tempgp.html

How to fix it

Whatever method you use, the change only takes effect after a restart. Plan the reboot as part of the change.

Domain-joined hosts: Group Policy

1. Edit a GPO linked to the affected computers and go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
2. Open User Account Control: Run all administrators in Admin Approval Mode, select Define this policy setting, choose Enabled.
3. While you are there, set the related items that usually appear in the same report (see the table below).
4. Run gpupdate /force /target:computer on a test host, then restart it.

The Wazuh check for ConsentPromptBehaviorAdmin also accepts 1 (Prompt for credentials on the secure desktop). This item belongs in every baseline GPO; the Windows Server hardening checklist covers the rest of the Security Options worth enforcing alongside it.

Standalone or workgroup hosts: registry

From an elevated prompt:

reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem" /v EnableLUA /t REG_DWORD /d 1 /f
reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 2 /f
reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem" /v FilterAdministratorToken /t REG_DWORD /d 1 /f
shutdown /r /t 60 /c "Re-enabling UAC (EnableLUA)"

The same three settings are available in the Local Security Policy console (secpol.msc) under Local Policies > Security Options if you prefer the GUI.

Intune-managed devices

Create a Settings catalog policy and use the “Run all administrators in Admin Approval Mode” setting in the Local Policies Security Options category. With a custom profile, the Policy CSP path is (Windows 10 version 1709 and later, Pro, Enterprise and Education):

./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
Data type: Integer    Value: 1 (Enable)

The related settings are UserAccountControl_BehaviorOfTheElevationPromptForAdministrators (2) and UserAccountControl_UseAdminApprovalMode (1). Devices still need a restart before the change is active.

How to verify the fix and rescan

After the restart:

reg query "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem" /v EnableLUA
whoami /groups | findstr /i "Mandatory"

Expect EnableLUA REG_DWORD 0x1 and, in a non-elevated window, Medium Mandatory Level. To check many hosts from an admin session, include the last boot time so you can spot hosts that have the value but have not restarted yet:

Invoke-Command -ComputerName (Get-Content .hosts.txt) -ScriptBlock {
    $p = Get-ItemProperty -Path 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem'
    [pscustomobject]@{
        EnableLUA                  = $p.EnableLUA
        ConsentPromptBehaviorAdmin = $p.ConsentPromptBehaviorAdmin
        FilterAdministratorToken   = $p.FilterAdministratorToken
        LastBoot                   = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
    }
} | Select-Object PSComputerName, EnableLUA, ConsentPromptBehaviorAdmin, FilterAdministratorToken, LastBoot

Then rerun the Tenable compliance scan, wait for the next Wazuh SCA pass, or rerun the Qualys policy scan. These checks read the registry, so a host can show PASSED before it has rebooted. Close the ticket only when the reboot is confirmed.

What can break and how to roll back

• The reboot itself. Schedule it; the setting does nothing until then.
• Admin habits and scripts. Tools launched from a normal window now run with the standard token and fail with access denied until started with “Run as administrator”.
• Credentialed scans with a local account. Tenable’s documentation offers disabling UAC as one option for local-account scans, and that is often why the 0 is there. Move scans to a domain account that is in the local Administrators group instead of turning UAC off again.
• Tools using the built-in Administrator. FilterAdministratorToken = 1 puts that account in Admin Approval Mode too, and Microsoft lists it among the settings that enforce local account restrictions for remote access. Scanners or scripts that relied on it over the network lose admin access.
• Legacy applications that write to Program Files, the Windows folder or HKLMSoftware without elevating can have those writes redirected to per-user locations (file and registry virtualization, on by default), which changes where they store data.

Back up the key first:

reg export "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem" C:Temppolicies-system.reg /y

If a critical application breaks, roll back narrowly: a GPO scoped to only the affected hosts with the policy set to Disabled, followed by a restart, and a documented exception. A local registry rollback on a domain-joined host is overwritten at the next Group Policy refresh.

Common false positive reasons

• Value missing. The Windows default is Enabled and Wazuh passes a missing value. If another audit engine fails a host with no value, set 1 explicitly; the host was not exposed.
• Stale results. The scan ran before the host picked up the GPO, or the host was offline during the refresh.
• Wrong value type. A script that wrote REG_SZ instead of REG_DWORD may not match what the check expects.
• The finding keeps coming back. This is not a false positive. Something rewrites the 0: an image, a scanner onboarding script or a conflicting GPO. If the report shows your GPO losing, see why a GPO is not applying.

The reverse also exists: a registry value of 0 written since the last boot means UAC is still running but will switch off at the next restart. That is a real finding, not noise.

FAQ

Does changing EnableLUA require a reboot?

Yes. Microsoft states the computer must be restarted before the policy is effective, whether it is set locally or through Group Policy.

Will re-enabling UAC break Nessus credentialed scans?

Only if the scan uses a local account other than the built-in Administrator (or the built-in Administrator after FilterAdministratorToken = 1). A domain account in the local Administrators group is not affected.

Is ConsentPromptBehaviorAdmin = 0 the same as disabling UAC?

No. Admin Approval Mode stays on, but elevation happens without any prompt. Microsoft says to use it only in the most constrained environments, and it fails CIS item 2.3.17.2.

If UAC is not a security boundary, why enforce it?

Because it makes administrators run as standard users until they approve elevation, so code started in an admin’s session does not get admin rights without a visible prompt. See Microsoft’s Windows security servicing criteria for how UAC is classified.

Tracking this finding across many hosts

When EnableLUA = 0 comes from a golden image or a scanner onboarding script, it shows up on every host built or onboarded the same way, sometimes in both Tenable and Wazuh results. SITEY, a self-hosted vulnerability management platform, imports findings from 16 scanners and merges duplicates within each scanner (not across scanners). Its AI can write host-specific remediation scripts that run only after human approval, deployed by its agents on Windows endpoints, and the platform re-tests after the fix to verify closure. Per-finding retest covers Nessus, Acunetix and Burp results; for Wazuh or Qualys compliance findings, confirm with that tool’s next scan.

Sources

• Microsoft Learn: User Account Control settings and configuration
• Microsoft Learn: User Account Control: Run all administrators in Admin Approval Mode
• Microsoft Learn: How User Account Control works
• Tenable: Credentialed Checks on Windows
• Wazuh: CIS Windows Server 2022 SCA policy