Disabling Remote User Account Control
The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC).
This content is not mapped to any local saved search. Add mapping
Disabling Remote User Account Control Help
To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications.
Open in Search