在我们的环境中，我发现了一些事件 ID 4776 The computer attempted to validate the credentials for an account。下面显示的是该事件日志的输出，似乎有问题的用户是Guest，这是一个禁用的帐户：
我还发现了来自同一时间和同一用户的相应事件 ID 4625，如下所示Guest。但是，对于此事件 ID，我可以看到我试图为其寻找用户的主题用户名。
我的问题是：
我有一个用户每隔几分钟就会被 UAC 提示有关Microsoft .Net Runtime请求管理员凭据的信息。每次用户点击No，UAC 会在几分钟后返回，如下所示：
我们的安全堆栈中没有任何内容被标记为恶意或阻止来自该用户设备的任何内容。但是，我确实找到了一些与UAC提示问题相关的日志。下面显示的是其中一个日志的输出：
[0B54:0AD4][2022-11-22T07:08:58]i001: Burn v3.14.0.5722, Windows v10.0 (Build 19044: Service Pack 0), path: C:\Users\User~1\AppData\Local\Temp\{85268AAC-6881-41DB-85FA-9DF8936C33C0}\.cr\DNCR605-KB4054530-x64-AllOS-ENU.exe
[0B54:0AD4][2022-11-22T07:08:58]i000: Initializing string variable 'BUNDLEMONIKER' to value 'Microsoft .NET Runtime - 6.0.9 (x64)'
[0B54:0AD4][2022-11-22T07:08:58]i000: Initializing string variable 'PRODUCT_NAME' to value 'Microsoft .NET Runtime - 6.0.9 (x64)'
[0B54:0AD4][2022-11-22T07:08:58]i000: Initializing string variable 'LINK_PREREQ_PAGE' to value 'https://go.microsoft.com/fwlink/?linkid=846817'
[0B54:0AD4][2022-11-22T07:08:58]i009: Command Line: '-burn.clean.room=C:\Users\User\AppData\Local\Temp\SupportAssistAgent\AutoUpdate\DNCR605-KB4054530-x64-AllOS-ENU.exe -burn.filehandle.attached=556 -burn.filehandle.self=572 /q /norestart'
[0B54:0AD4][2022-11-22T07:08:58]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\User\AppData\Local\Temp\SupportAssistAgent\AutoUpdate\DNCR605-KB4054530-x64-AllOS-ENU.exe'
[0B54:0AD4][2022-11-22T07:08:58]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\User\AppData\Local\Temp\SupportAssistAgent\AutoUpdate\'
[0B54:0AD4][2022-11-22T07:08:58]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\User~1\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.9_(x64)_20221122070858.log'
[0B54:0AD4][2022-11-22T07:08:58]i000: Setting string variable 'WixBundleName' to value 'Microsoft .NET Runtime - 6.0.9 (x64)'
[0B54:0AD4][2022-11-22T07:08:58]i000: Setting string variable 'WixBundleManufacturer' to value 'Microsoft Corporation'
[0B54:2CE4][2022-11-22T07:08:58]i000: Setting numeric variable 'WixStdBALanguageId' to value 1033
[0B54:2CE4][2022-11-22T07:08:58]i000: Setting version variable 'WixBundleFileVersion' to value '6.0.9.31619'
[0B54:0AD4][2022-11-22T07:08:58]i100: Detect begin, 3 packages
[0B54:0AD4][2022-11-22T07:08:58]i101: Detected package: dotnet_runtime_6.0.9_win_x64.msi, state: Absent, cached: None
[0B54:0AD4][2022-11-22T07:08:58]i101: Detected package: dotnet_hostfxr_6.0.9_win_x64.msi, state: Absent, cached: None
[0B54:0AD4][2022-11-22T07:08:58]i101: Detected package: dotnet_host_6.0.9_win_x64.msi, state: Absent, cached: None
[0B54:0AD4][2022-11-22T07:08:58]i052: Condition '((VersionNT > v6.1) OR (VersionNT = v6.1 AND ServicePackLevel >= 1))' evaluates to true.
[0B54:0AD4][2022-11-22T07:08:58]i052: Condition 'VersionNT64' evaluates to true.
[0B54:0AD4][2022-11-22T07:08:58]i199: Detect complete, result: 0x0
[0B54:0AD4][2022-11-22T07:08:58]i200: Plan begin, 3 packages, action: Install
[0B54:0AD4][2022-11-22T07:08:58]i000: Setting string variable 'WixBundleRollbackLog_dotnet_runtime_6.0.9_win_x64.msi' to value 'C:\Users\User~1\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.9_(x64)_20221122070858_000_dotnet_runtime_6.0.9_win_x64.msi_rollback.log'
[0B54:0AD4][2022-11-22T07:08:58]i000: Setting string variable 'WixBundleLog_dotnet_runtime_6.0.9_win_x64.msi' to value 'C:\Users\User~1\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.9_(x64)_20221122070858_000_dotnet_runtime_6.0.9_win_x64.msi.log'
[0B54:0AD4][2022-11-22T07:08:58]i000: Setting string variable 'WixBundleRollbackLog_dotnet_hostfxr_6.0.9_win_x64.msi' to value 'C:\Users\User~1\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.9_(x64)_20221122070858_001_dotnet_hostfxr_6.0.9_win_x64.msi_rollback.log'
[0B54:0AD4][2022-11-22T07:08:58]i000: Setting string variable 'WixBundleLog_dotnet_hostfxr_6.0.9_win_x64.msi' to value 'C:\Users\User~1\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.9_(x64)_20221122070858_001_dotnet_hostfxr_6.0.9_win_x64.msi.log'
[0B54:0AD4][2022-11-22T07:08:58]i000: Setting string variable 'WixBundleRollbackLog_dotnet_host_6.0.9_win_x64.msi' to value 'C:\Users\User~1\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.9_(x64)_20221122070858_002_dotnet_host_6.0.9_win_x64.msi_rollback.log'
[0B54:0AD4][2022-11-22T07:08:58]i000: Setting string variable 'WixBundleLog_dotnet_host_6.0.9_win_x64.msi' to value 'C:\Users\User~1\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.9_(x64)_20221122070858_002_dotnet_host_6.0.9_win_x64.msi.log'
[0B54:0AD4][2022-11-22T07:08:58]i201: Planned package: dotnet_runtime_6.0.9_win_x64.msi, state: Absent, default requested: Present, ba requested: Present, execute: Install, rollback: Uninstall, cache: Yes, uncache: No, dependency: Register
[0B54:0AD4][2022-11-22T07:08:58]i201: Planned package: dotnet_hostfxr_6.0.9_win_x64.msi, state: Absent, default requested: Present, ba requested: Present, execute: Install, rollback: Uninstall, cache: Yes, uncache: No, dependency: Register
[0B54:0AD4][2022-11-22T07:08:58]i201: Planned package: dotnet_host_6.0.9_win_x64.msi, state: Absent, default requested: Present, ba requested: Present, execute: Install, rollback: Uninstall, cache: Yes, uncache: No, dependency: Register
[0B54:0AD4][2022-11-22T07:08:58]i299: Plan complete, result: 0x0
[0B54:0AD4][2022-11-22T07:08:58]i300: Apply begin
[0B54:0AD4][2022-11-22T07:08:58]i010: Launching elevated engine process.
从上面看，似乎正在尝试自动更新任务。为了完成它，它需要更高的权限。但是，如果用户单击No它应该结束。
谁能帮助阻止 UAC 不断提示？
我遇到了令人头疼的情况。我有一个用户报告说他们正在从 Outlook 中弹出一个 Windows 安全性，即使在单击“取消”或注销/登录到 Outlook 后仍会继续显示。
幸运的是，用户没有输入他们的凭据。
以下是我从安全角度检查的一些内容：
任何人都可以帮助解释为什么这会不断为用户弹出？另外，我们如何阻止这种情况再次发生？
我目前正在使用 Ansible 的免费版本。单个 Ansible 控制器可以管理的最大主机数是多少？我认为这取决于服务器上提供的资源，但似乎找不到免费版本的文档。
此外，在像下面的示例这样的分段网络中（混合了 Windows 和 Linux 机器），我不太确定，但我认为每个网段都需要一个控制器。这个对吗？：
最后，需要开放的端口要求和方向是什么？