Digital Signature Validation for UAC Escalation

The problem with UAC has always been user discretion. They just click YES 99% of the time, even advanced users. One thing you can do to mitigate this is change the local or group security policy so that applications that require UAC elevation must not only be *signed*, but also have that signature *validated*. Now, to validate a signature requires some network overhead, so it is a bit slow, but not that bad.

Why is this important? These days, even malware is signed. However, their signatures are often revoked or self-issued, so will not pass this validation test.

Possible complications include improperly signed legitimate applications, expired certificates (e.g. old version), or unsigned legacy applications.

Some users, especially in corporate or small business environments, may wish to turn this option on - or at least experiment with it, and see how it does for you.

(shameless plug) Applications like Process Lasso (automation and optimization) are designed to work well with such restrictions, having all modules signed, so long as you have the current version.