📄️ User Account Control (UAC)
User Account Control (UAC) is a Windows security feature that prevents unauthorized changes by requiring administrative approval for certain actions. It helps mitigate malware infections by running processes with standard privileges unless explicitly elevated. UAC prompts appear when a program requests elevated permissions, ensuring user awareness of system modifications. Disabling UAC reduces security, making the system more vulnerable to privilege escalation attacks.
📄️ Always Install Elevated
AlwaysInstallElevated is a Windows policy setting that allows MSI installers to run with elevated (admin) privileges. It is configured via Group Policy or registry keys. While useful for deploying software enterprise-wide, it poses a serious security risk if misused, as attackers can exploit it to gain system-level access. It is recommended to disable this setting unless absolutely necessary.
📄️ Weak Permissions
SharpUP can audit for weak ACLs easily in one run.
📄️ Windows Kiosk and Restricted Desktop Breakout
A Windows kiosk (assigned access, single-app mode, or a locked-down session) runs one application in a restricted desktop. Typical deployments are airport check-in terminals, retail point of sale units, self-service kiosks, and locked-down thin clients. Win+R, Task Manager, Ctrl+Shift+Esc and often Ctrl+Alt+Del are disabled, File Explorer is restricted, and the user is expected to use only the kiosk application.
📄️ Citrix and Published Desktop Breakout
Many organizations deliver remote access through application and desktop virtualization: Citrix Virtual Apps and Desktops, Microsoft Terminal Services / RemoteApp, AWS AppStream, CyberArk PSM, VMware Horizon, and dedicated kiosks. To limit the impact of a compromised account, the published desktop is locked down, but a restricted desktop can almost always be escaped.