M1052 User Account Control: User Account Control Settings Against Elevation Abuse

Most Windows estates run User Account Control at its default level, which lets auto-elevating Windows binaries skip the prompt and gives attackers a well-documented route from medium to high integrity. MITRE ATT&CK mitigation M1052 User Account Control treats the UAC policy set as a control in its own right: turn it on everywhere, raise the enforcement level, deny elevation to standard users, and apply UAC remote restrictions to local accounts. This guide maps M1052 to the seven ATT&CK v20 techniques it mitigates, gives the exact policy and registry settings, explains where UAC stops and what covers the gaps, and shows how to measure coverage. It is written for Windows platform engineers, detection engineers and security architects who own endpoint baselines.

Key takeaways

• Seven techniques, one theme. In ATT&CK v20, M1052 mitigates T1548 and T1548.002 Bypass User Account Control, T1550.002 Pass the Hash, T1546.011 Application Shimming and three Hijack Execution Flow entries (T1574, T1574.005, T1574.010): all depend on an administrator token being easy to obtain.
• The default is not the highest level. The administrator prompt default is "Prompt for consent for non-Windows binaries", which is the level where auto-elevation applies; ATT&CK advises the highest enforcement level.
• Standard users should be denied, not prompted. Setting the standard user prompt to "Automatically deny elevation requests" removes the over-the-shoulder and installer elevation routes that T1574.005 and T1574.010 rely on.
• Remote restrictions are the pass the hash control. Keep LocalAccountTokenFilterPolicy at 0 so local administrator accounts get a filtered token over the network; this setting is routinely flipped to 1 by deployment tools and never reverted.
• UAC is not a security boundary. Microsoft lists it as a defence-in-depth feature, so pair M1052 with privileged account management, removal of local admin rights, patching and detection rather than relying on it alone.

What M1052 is in ATT&CK terms

ATT&CK describes M1052 User Account Control as configuring the Windows UAC feature to reduce privilege escalation risk. Its implementation guidance names five measures: enable UAC globally through "Run all administrators in Admin Approval Mode", require a credential prompt rather than simple consent, put the built-in Administrator account into Admin Approval Mode, show prompts on the secure desktop, and allow elevation only for signed and validated executables. It also points to monitoring process creation (Windows event 4688) and to EDR detection of known bypass methods.

The mechanism behind all of this is the split token. Microsoft's How UAC works page explains that an administrator who signs in receives a standard user token with the administrative privileges and SIDs removed, plus a full administrator token that is only used after consent or credentials are given. Processes carry integrity levels, and lower-integrity processes cannot modify higher-integrity ones. M1052 is about making the step from the filtered token to the full token deliberate, visible and, where possible, impossible for non-administrators.

Microsoft's Windows security servicing criteria list UAC as a defence-in-depth feature under "User safety", not as a security boundary, and administrator-to-kernel is explicitly listed as a non-boundary. In practice this means individual UAC bypasses may not be fixed as vulnerabilities, which is why ATT&CK pairs M1052 with other mitigations for every technique it covers.

Techniques M1052 mitigates

The table lists all seven non-revoked techniques linked to M1052 in ATT&CK v20 (enterprise-attack 20.0), with the guidance ATT&CK gives for each and the other mitigations ATT&CK lists alongside it.

For the technique detail and detection analytics, see the MITRE ATT&CK T1548 Abuse Elevation Control Mechanism, the MITRE ATT&CK T1550 Use Alternate Authentication Material Guide, the T1574 Hijack Execution Flow Defensive Guide and the T1546 Event Triggered Execution Defensive Guide.

Priority order

1. T1550.002 Pass the Hash: highest value because it limits lateral movement with a reused local administrator password across many hosts, and the fix is one setting.
2. T1548.002 Bypass User Account Control: common in commodity malware and hands-on intrusions on hosts where users are local administrators.
3. T1574.005 and T1574.010: matter wherever standard users can write to installer or service binary paths.
4. T1546.011 Application Shimming: lower frequency; "Always Notify" is the M1052 lever, with update hygiene doing most of the work.

The UAC settings that implement M1052

All settings live under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options (or the Local Policies Security Options category of an Intune Settings catalog policy). Defaults are as stated on Microsoft's UAC settings and configuration page. Registry values sit under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.

On LocalAccountTokenFilterPolicy, Microsoft's UAC remote restrictions article states that value 0 builds a filtered token and is the default, while 1 builds an elevated token. With restrictions on, a local Administrators group member connecting remotely has no elevation potential. The same article notes that domain accounts in the local Administrators group are not filtered and run with a full token remotely, so this setting does not replace tiering of domain administrator accounts.

Administrator protection

Windows 11 now offers administrator protection, an evolution of Admin Approval Mode in which elevation runs in a hidden, system-generated, profile-separated account, every admin operation must be authorised interactively through Windows Hello, and the admin token is discarded after use. As stated by Microsoft in November 2026, it is available with KB5120998, off by default, configured through "User Account Control Type Of Admin Approval Mode", and becomes enabled by default for organisations using Windows security baselines with the October 2026 security update. It does not yet apply to Windows Server, Windows 365 Cloud PCs or Azure Virtual Desktop session hosts. Where it is available, NHI Mgmt Group recommends piloting it as the strongest form of M1052, because it removes the auto-elevation behaviour that most UAC bypasses depend on.

Implementation in phases

1. Inventory current state: collect the registry values above from every Windows endpoint and server through your configuration management or EDR inventory. Flag any host with EnableLUA 0, ConsentPromptBehaviorAdmin 0 (elevate without prompting) or LocalAccountTokenFilterPolicy 1.
2. Fix the dangerous outliers first: re-enable UAC and reset LocalAccountTokenFilterPolicy to 0 through Group Policy or Intune so the setting is enforced, not just corrected once. Identify which deployment or monitoring tool set it to 1 and move that tool to a domain or managed account with proper rights.
3. Deny standard user elevation: set ConsentPromptBehaviorUser to automatically deny. Pilot with a ring that includes helpdesk and field staff, and route legitimate installation needs through software deployment or an endpoint privilege management workflow. See the Endpoint Privilege Management Guide.
4. Raise the administrator prompt: move privileged access workstations and server administrators to credential prompts on the secure desktop. Leave general administrators on consent on the secure desktop if credential prompts break workflows, and record the exception.
5. Close the built-in Administrator gap: enable FilterAdministratorToken and rotate the built-in account password per device with LAPS. See the Local Administrator Password Solution (LAPS) Guide.
6. Tighten signing: enable ValidateAdminCodeSignatures after an audit period in which you log which elevated executables are unsigned.
7. Roll back safely: keep each change in its own policy object so a single setting can be reverted for one ring. Never roll back by disabling EnableLUA, which removes all UAC protection and requires a restart.

Decision guidance

Smaller organisations get most of the value from three changes: deny standard user elevation, keep LocalAccountTokenFilterPolicy at 0 and deploy LAPS. Larger organisations should add credential prompts on admin tiers, signed-only elevation and administrator protection pilots.

Where identity fits

UAC is an identity control for local accounts. The built-in Administrator account, local accounts created by imaging, and local service or automation accounts used by deployment tools are non-human identities that often share passwords across hosts. ATT&CK's T1550.002 guidance exists because a shared local administrator hash plus LocalAccountTokenFilterPolicy 1 turns one compromised host into many. Unique local passwords (LAPS), remote restrictions and managed service identities such as gMSA together break that chain. See the Pass-the-Hash and Pass-the-Ticket Guide and the Group Managed Service Accounts (gMSA) Guide.

What M1052 does not stop

• Auto-elevation bypasses at default settings: ATT&CK notes that if the protection level is anything but the highest, certain Windows programs can elevate or run elevated COM objects without a prompt. Raising the level narrows this but bypass methods continue to be published.
• Users who are already administrators: a bypass only removes a prompt; the user already owns an admin token. Removing local admin rights (M1026) matters more than the prompt level.
• Remote use of admin credentials: ATT&CK notes UAC is a single-system mechanism, so known administrator credentials used for lateral movement default to high integrity on the remote host. Domain accounts are not filtered by remote restrictions.
• Kernel and driver attacks: administrator-to-kernel is not a boundary in Microsoft's servicing criteria; driver control belongs to other mitigations.
• Non-Windows platforms: M1052 is Windows only; sudo configuration and elevation on macOS and Linux fall under T1548 sub-techniques and other mitigations.

Detection and measurement

Enable Audit Process Creation and "Include command line in process creation events" so event 4688 records the Token Elevation Type and Mandatory Label, as documented in Microsoft's event 4688 reference. Type %%1937 means an elevated token, %%1938 a limited token, and %%1936 a full token where UAC is disabled or the account is the built-in Administrator, a service account or Local System. A high integrity process (S-1-16-12288) whose parent runs at medium integrity, without a consent.exe interaction, is a classic bypass signal. Also alert on changes to the Policies\System registry values above, which are covered by registry auditing or Sysmon registry events.

To verify the control, an authorised red team or purple team can run a known UAC bypass test case in a lab ring and confirm that it is either blocked or detected, then repeat after each Windows feature update.

Framework mapping and related controls

Related ATT&CK mitigations: M1026 Privileged Account Management, M1018 User Account Management, M1047 Audit and M1051 Update Software.

Common failure patterns

• LocalAccountTokenFilterPolicy left at 1: set once for a deployment or scanning tool and never reverted, which re-opens pass the hash with local administrator accounts across the estate.
• Treating the prompt as the control: users who are local administrators click through consent prompts, and bypasses remove the prompt entirely; the real control is removing admin rights.
• Disabling UAC on servers "because nobody logs on": service and automation accounts then run with full tokens, and 4688 shows %%1936 everywhere, which hides real abuse.
• Built-in Administrator outside Admin Approval Mode: FilterAdministratorToken defaults to disabled, so a shared built-in Administrator password gives a full token with no prompt.
• No monitoring of UAC policy keys: attackers and admin tools change Policies\System values, and without registry auditing the change goes unseen.

Practitioner checklist

• Enforce EnableLUA = 1 through Group Policy or Intune on every Windows host.
• Set standard user elevation to "Automatically deny elevation requests".
• Move admin tiers to credential prompts on the secure desktop; keep PromptOnSecureDesktop enabled.
• Enable Admin Approval Mode for the built-in Administrator and deploy LAPS.
• Enforce LocalAccountTokenFilterPolicy = 0 and find every tool that needed it at 1.
• Pilot ValidateAdminCodeSignatures and administrator protection on privileged access workstations.
• Collect 4688 with command line and alert on medium-to-high integrity transitions without consent.
• Audit and alert on changes to the UAC policy registry key.
• Track the share of users with local admin rights and drive it down.

Standards and references

• MITRE ATT&CK: M1052 User Account Control
• MITRE ATT&CK: T1548.002 Bypass User Account Control
• Microsoft Learn: User Account Control settings and configuration
• Microsoft Learn: How User Account Control works
• Microsoft Learn: Description of User Account Control and remote restrictions
• Microsoft Learn: Administrator protection
• Microsoft Learn: 4688 A new process has been created
• Microsoft Security Response Center: Windows security servicing criteria

Related NHI Mgmt Group resources: MITRE ATT&CK T1548 Abuse Elevation Control Mechanism · Local Administrator Password Solution (LAPS) Guide · Endpoint Privilege Management Guide · Pass-the-Hash and Pass-the-Ticket Guide · M1026 Privileged Account Management