REMCOS UAC Disable via reg.exe Setting EnableLUA to 0

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•9

Detects the modification of the EnableLUA registry key via the reg.exe utility. Setting EnableLUA to 0 effectively disables Windows User Account Control (UAC), which is a common post-exploitation technique used to elevate privileges or bypass security prompts.