Exam MD-100 topic 5 question 75 discussion

Just tested this on a WORKGROUP VM 21H2 and they are all NO. No Consent was asked for any of the users. The policy "UAC: Run all administrators in Admin Approval Mode: Disabled" turns off all UAC prompts.

The policy settings "UAC: Run all administrators in Admin Approval Mode: Disabled" will completely turn off UAC

I think it should be YNY. 2th user is not a build in administrator, therefore the rule of build in consent prompt will not be used on user 2, as its not a build in adminstrator. Only the first account created on a system is the build in administrator

Yes,Yes, Yes This policy setting determines the behavior of Admin Approval Mode for the built-in administrator account. When the Admin Approval Mode is enabled, the local administrator account functions like a standard user account, but it has the ability to elevate privileges without logging on by using a different account. In this mode, any operation that requires elevation of privilege displays a prompt that allows the administrator to permit or deny the elevation of privilege. If Admin Approval Mode is not enabled, the built-in Administrator account runs all applications by default with full administrative privileges. By default, Admin Approval Mode is set to Disabled.

I have all set as 'NO'. Admin Approval mode is disabled Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode

everything on no as UAC is disbled as per GPO

Essa questão ficou muito dividida no gabarito, afinal qual seria a resposta e qual a justificativa? Após um debate de 4 comentários, o gabarito é o mesmo ou não? Yes - Yes - Yes ou Sim, Não e Sim?

The "User Account Control: Run all administrators in Admin Approval Mode" policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. The policy is disabled. The options are: Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. Because this policy is disabled, administrators are not prompted for approval. Non-administrators are not prompted to enter administrator credentials when starting the command prompt with elevated rights. Instead, the command prompt is started in standard user mode without any prompts or notes. Note: If this policy were activated, all three statements would be correct and answered with "yes".

"Run all administrator in Admin Approval Mode" Disabled" tried on my VM and it is still getting prompt for consent . So the answer is correct

I believe it is yes, no, yes. User1 is in the administrator group, but according to the group policy it falls under "Run all administrator in Admin Approval Mode" Disabled, while the default Admin account has another run to enable it higher up in "admin approval mode for the built in administrator account." Could someone verify if my thinking is right? I could see the default being to ask for consent at minimum so maybe it defaults to that?

all is correct