Hardening Windows Endpoints: Blocking Unauthorized Software Installations via Intune Policy
In modern endpoint security, controlling how software is installed is just as important as controlling who has access.
One frequently overlooked risk in Windows environments is how application installers request elevated privileges. Many installation packages attempt to run with administrator rights. If this behavior is not properly managed, it can introduce unauthorized software, unwanted system changes, or even malicious components into the environment.
By using Microsoft Intune, organizations can enforce a policy that ensures Windows actively detects installers requiring elevation and prevents them from running silently.
When enabled, this setting forces administrative approval before privileged software installations can proceed. This prevents background installations, hidden elevation attempts, and unintended system-level modifications.
The result is simple: users continue working normally, while Windows enforces an additional layer of protection whenever elevated privileges are requested.
Why This Policy Matters
In enterprise environments, most users operate under standard accounts to minimize risk. However, many application installers are designed to request elevation dynamically.
Without proper controls:
Installers may attempt privilege escalation
Users may unknowingly approve risky prompts
Silent installations may introduce unapproved software
System integrity may be altered without centralized visibility
By enforcing detection of elevated installers:
Unauthorized software installations are blocked
Privilege escalation attempts are controlled
Endpoint hardening is strengthened
Administrative approval becomes intentional and auditable
The attack surface is reduced without impacting productivity
This policy supports least privilege, Zero Trust, and proactive endpoint governance strategies.
How the Policy Strengthens Security Governance
This configuration ensures that Windows actively evaluates installer behavior before granting elevated access.
When enabled:
Installers requiring administrative privileges are detected
Silent or hidden installation attempts are prevented
Users must provide valid administrator credentials
System-level changes require intentional approval
This shifts control back to IT and security teams while preserving a seamless user experience.
The policy operates at the device level and remains enforced across reboots and user sessions.
Windows CSP Overview
This configuration is deployed using the Windows Policy CSP framework and applies at the device scope.
Once enforced, it ensures consistent installer behavior regardless of which user signs in.
Supported Editions:
Windows 10 Pro
Windows 10 Enterprise
Windows 10 Education
Windows 11 Pro
Enterprise
Education
This makes it suitable for modern Intune-managed environments.
Policy Properties
The configuration framework uses a structured and reliable format:
Format: Integer (int)
Access Type: Add, Delete, Get, Replace
Default Value: 1 (Enabled)
This allows administrators to deploy, modify, or replace the configuration consistently using Intune configuration profiles.
Because it is enforced at the CSP level, the setting remains persistent and centrally managed.
Allowed Values Explained
This policy supports two configuration values:
1 (Enabled – Recommended) Windows actively detects installers that require administrative privileges and blocks silent execution. Administrative credentials are required before continuing.
0 (Disabled – Not Recommended) Installers requiring elevation may proceed without strict detection controls, increasing the risk of unauthorized or hidden installations.
Keeping this setting enabled enforces a least-access-by-default model that significantly reduces endpoint risk without affecting user productivity.
Group Policy Mapping (For Reference)
For organizations operating in hybrid or legacy management environments, this CSP aligns directly with the equivalent Group Policy setting.
Policy Name: User Account Control: Detect application installations and prompt for elevation
Location: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
This makes the control easy to audit and maintain alignment between modern Intune deployments and traditional Group Policy environments.
How to Configure Detection of Privileged App Installations Using Intune (Settings Catalog)
You can enforce this policy centrally using the Intune Settings Catalog, ensuring consistent control over application installation behavior across all Windows devices.
To begin, sign in to the Microsoft Intune admin center and follow the steps below, as illustrated in the screenshot.
Create the Configuration Profile
In the Microsoft Intune admin center:
Navigate to Devices
Select Windows
Click Configuration
Select + Create policy
In the Create a profile pane:
Platform: Windows 10 and later
Profile type: Settings catalog
Click Create to continue.
At this stage, you have created the foundation of a Settings Catalog policy. In the next steps, you will search for and configure the setting that controls detection of application installations requiring administrative privileges.
This ensures that Windows prompts for elevation whenever privileged installer behavior is detected, preventing silent or unauthorized system-level changes across all managed endpoints.
Define Basic Profile Details
After clicking Create, the next step is to define the basic details of the configuration profile. This stage is essential for long-term management, clarity, and governance within Microsoft Intune especially in environments with multiple endpoint hardening policies and security baselines.
Providing a clear Name and a concise but meaningful Description ensures that the purpose of the policy is immediately understood by administrators and security teams in the future.
As shown in the screenshot, configure the fields as follows:
Policy Name and Description
Name WIN – Endpoint Hardening – Restrict Privileged App Installs
Description This policy strengthens endpoint security by requiring administrative credentials for applications requesting elevated permissions. It mitigates the risk of unauthorized software deployment and protects system integrity.
The Platform field is already pre-selected as Windows, so no changes are required.
Once the name and description are defined, click Next to proceed to the configuration settings.
Configure the Setting Using the Settings Picker
With the profile basics defined, the next step is to configure the policy using the Settings picker, where you select the exact Windows security setting to enforce.
Click Add settings to open the Settings picker panel.
By default, this setting is not configured, which means Windows will follow its existing behavior and will not explicitly enforce this hardening control through Intune unless you enable it.
As shown in the screenshot, use the search field at the top of the Settings picker and type:
Detect Application Installations and Prompt for Elevation
Then click Search to filter the results.
From the returned results:
Select the Local Policies Security Options category
Choose the setting: User Account Control: Detect Application Installations And Prompt For Elevation
Once selected, the setting is added to the configuration profile. Back on the configuration page, change the value from its default state to Enable.
When enabled, Windows actively detects installer packages that request elevated permissions and prompts for administrator credentials before allowing the installation to continue. This prevents silent or unauthorized system-level changes and reduces the risk of unapproved software being deployed on corporate endpoints.
This configuration aligns with modern endpoint hardening practices and supports least privilege and Zero Trust principles by ensuring elevated installation activity is always intentional, controlled, and governed.
After configuring the setting, click Next to continue with the profile deployment steps.
Configure Scope Tags (Optional)
Scope tags are used to control who can view and manage this policy within the Microsoft Intune admin center. They are particularly useful in environments with delegated administration, multiple IT teams, or regional management models.
As shown in the screenshot, the Default scope tag is selected. This is the standard and recommended configuration for most environments, as it ensures the policy is visible to all administrators who have access to Intune.
Optionally, custom scope tags can be assigned if you need to:
Restrict policy visibility to specific IT roles or teams
Enforce administrative separation of duties
Support delegated or region-based Intune management
If no additional scope tags are required, keep the Default selection and click Next to continue.
Assignments – Restrict Anonymous Access Policy
After configuring the policy settings, the next step is to assign the policy to the appropriate target group. Assignments define which devices will receive and enforce this configuration, ensuring the policy is applied in a controlled and intentional manner.
In the Assignments tab, click Add groups under Included groups and search for the group you want to target. This approach allows you to deploy the policy gradually, starting with test devices before expanding to production.
As shown in the screenshot, the policy is assigned to the following group:
GRP – MS365Education – Test Computers
Once the group is selected, verify the following:
The group appears under Included groups
The group status is Active
No assignment filters are applied (unless explicitly required)
At this stage, no Excluded groups are configured, which is appropriate for controlled test deployments.
After confirming the assignment, click Next to proceed to the Review + Create step.
Review + Create – Final Validation
The Review + Create step is the final checkpoint before deploying the policy. This is where you validate that all configurations are correct and aligned with your intended endpoint hardening objective.
Pay special attention to the following items:
Policy name and description Confirm that the policy clearly reflects its purpose: strengthening endpoint security by detecting application installations that require elevated privileges and enforcing administrative approval.
Configuration settings Verify that User Account Control: Detect Application Installations And Prompt For Elevation is set to Enabled under Local Policies Security Options.
Scope tags Ensure the correct scope tag is assigned. In this example, the Default scope tag is used.
Assignments Confirm the policy is assigned to the intended group: GRP – MS365Education – Test Computers Also verify that no unintended exclusions are configured.
This final review step helps prevent misconfigurations, unintended deployments, or scope issues especially in environments with multiple security baselines, delegated administration, and layered endpoint policies.
Once everything has been validated, click Review + Create to finalize and deploy the policy to the assigned devices.
Monitor Policy Deployment Status
After creating and assigning the WIN – Endpoint Hardening – Restrict Privileged App Installs configuration profile, the next critical step is to monitor its deployment status.
This verification ensures that the policy has been successfully applied and is actively enforcing detection of privileged application installations on the targeted Windows devices.
Although Microsoft Intune can take up to 8 hours to automatically deliver configuration profiles, deployment often occurs much faster. If needed, you can accelerate the process by:
Manually triggering a device sync from the Company Portal
Forcing a sync directly from the Microsoft Intune admin center
Monitoring deployment status is essential to confirm that the endpoint hardening control is active and protecting devices as intended.
How to Verify Policy Deployment Status
To review the deployment results:
In the Microsoft Intune admin center, navigate to: Devices ➝ Configuration profiles
Use the search bar to locate the profile: WIN – Endpoint Hardening – Restrict Privileged App Installs
Select the policy to open the Overview page.
Review Deployment Metrics
Intune provides clear deployment indicators that allow administrators to quickly assess the policy state:
Succeeded – Devices have successfully applied the policy.
In progress – Devices are still processing the configuration or have not checked in yet.
Error – The policy failed to apply and requires investigation.
Not applicable – The device does not support this specific setting.
When devices report Succeeded, it confirms that Windows is now actively detecting application installations that require elevated privileges and prompting for administrative approval before allowing execution.
This means:
Silent elevated installations are blocked
Privilege escalation attempts are controlled
Endpoint security posture is strengthened
Installation governance is centrally enforced through Intune
Monitoring this stage ensures that your hardening strategy is not just configured but truly enforced across your managed environment.
Why This Validation Matters
Monitoring deployment status ensures that:
Privileged installation detection is actively enforced
Elevated installer behavior is controlled as intended
There are no silent failures or unsupported devices
Your endpoint hardening baseline remains consistent across managed Windows devices
This final validation step closes the loop on the policy lifecycle from design and deployment to enforcement and verification reinforcing a secure, predictable, and governed installation process across your environment.
Hardening is not complete until it is verified.
Client-Side Verification via Event Viewer
After the device has synced with Intune, you can perform a client-side verification to confirm that the WIN – Endpoint Hardening – Restrict Privileged App Installs policy was successfully applied.
This validation is especially useful for troubleshooting and ensuring that privileged installation detection is actively enforced at the operating system level.
Windows records Intune policy processing events locally, allowing administrators to verify enforcement without relying solely on portal reporting.
How to Verify
Open Event Viewer on the target device
Navigate to: Applications and Services Logs ➝ Microsoft ➝ Windows ➝ DeviceManagement-Enterprise-Diagnostics-Provider ➝ Admin
Select Filter Current Log…
Look for Event ID 813 or Event ID 814, which indicate successful processing of Intune configuration policies
Open the event details and confirm that the policy User Account Control: Detect Application Installations And Prompt For Elevation was applied successfully
Pro Tip
Match the event timestamp with the device’s most recent Intune sync.
Event IDs 813 and 814 are the most reliable indicators that the configuration policy was evaluated and enforced by the MDM engine.
If the policy is correctly processed, Windows will now detect installer packages requesting elevation and trigger administrative prompts accordingly.
Why This Matters for Endpoint Security
Uncontrolled application installation is one of the most common entry points for risk in enterprise environments.
Attackers frequently attempt to:
Deliver malicious software disguised as legitimate installers
Trigger elevation prompts to gain administrative access
Deploy software silently through privilege escalation techniques
Modify system components without centralized visibility
By enforcing detection of privileged installations through Intune and validating it locally, organizations ensure that:
Elevated installer activity is intentional and controlled
Silent installation attempts are blocked
Privilege escalation vectors are reduced
Administrative approval becomes mandatory
Least privilege is enforced at the operating system level
This is a practical and highly effective hardening control that strengthens your security posture without disrupting legitimate business operations.
Key Takeaway
Security hardening does not always require complex architectures.
Sometimes, a single well-governed configuration can eliminate an entire category of risk.
By enforcing privileged installation detection via Microsoft Intune, you ensure that no system-level software change happens without explicit administrative approval.
Combined with centralized deployment and reliable validation, this policy transforms application installation from a user-driven action into a controlled, governed security process.
And in modern endpoint security, control equals protection.
More Information
For additional technical details, official documentation, and deeper insights into this policy and related Microsoft Intune concepts, refer to the Microsoft Learn resources below:
Intune Configuration and Policy Basics
Create a policy using the Settings Catalog in Microsoft Intune – Step-by-step guidance on creating and managing Settings Catalog policies for Windows devices. Create a policy using Settings Catalog (Microsoft Learn)
Device configuration profiles in Intune – Overview of how configuration profiles work across managed devices. Device features and settings in Microsoft Intune (Microsoft Learn)
Windows Security Settings & CSP Reference
User Account Control (UAC) settings and configuration – Official Windows documentation on UAC policies including installer detection behavior. User Account Control settings and configuration (Microsoft Learn)
Policy Monitoring & Troubleshooting
See device configuration policies with Microsoft Intune – How to check assignment status, view filters, and interpret deployment reports. See device configuration policies with Microsoft Intune (Microsoft Learn)
Troubleshoot policies and profiles in Microsoft Intune – Guidance on troubleshooting common policy application issues. Troubleshooting policies and profiles in Microsoft Intune (Microsoft Learn)
Event Logs & Local Validation
(Note: Microsoft Learn does not currently have a dedicated page specifically for MDM Event Viewer logs, but the general Intune troubleshooting guidance includes related diagnostic practices.)
These resources provide a foundation for understanding how Intune enforces configuration CSPs like User Account Control: Detect Application Installations And Prompt For Elevation, how deployment is monitored, and how you can verify enforcement both in the portal and at the device level.
Thank you!
🖥️ Ricardo Barbosa
🎖️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect |💼 Technology Director at Altelix.com