Event banner
Event details
Is there a way to prevent admin users from changing the UAC setting, either through registry settings or Intune? We configure the "Administrator elevation prompt behavior" UAC setting through the Security Baseline. However, admin users can change or turn off UAC and this will stay until the devices syncs or is restarted. This leaves the device vulnerable for up to 8 hours. We changed this setting in the Security Baseline to "not configured" and created a configuration profile to set it. Most settings that get configured using a configuration profile are greyed out, but that is not the case for UAC.
This isn't a solution but it may be a partial workaround for you, Mike. Admin users are allowed to change UAC settings by design but if you use Intune, you can probably create a proactive remediation that checks to see if UAC is disabled and flips the switch.