A workstation is repeatedly reinfected with malware, and investigation shows the user signs in with a local administrator account for everyday work. Which hardening change BEST reduces the recurrence while keeping User Account Control protection intact?
- ADisable User Account Control so the elevation prompts stop interrupting the user.
- BConvert the user to a standard account and supply admin credentials at the prompt when elevation is needed. Correct
- CTurn on the built-in Guest account so risky browsing happens in that context.
- DRaise the account lockout threshold to slow down any password-guessing attacker.
Why A is wrong: Tempting because the prompts are annoying, but disabling UAC removes a key defence and lets malware elevate silently, making reinfection more likely rather than less.
Why B is correct: Correct: least privilege means malware runs with limited rights and cannot install system-wide, while UAC still prompts for genuine elevation, breaking the reinfection pattern.
Why C is wrong: Sounds like isolation, but the Guest account is a security liability that should stay disabled, and it does nothing to stop the admin-context infections.
Why D is wrong: Lockout policy counters brute-force sign-ins, not malware executing under an existing admin session, so it does not address the observed cause.