The 'User Account Control: Behavior of the elevation prompt for standard users' setting should be configured correctly.
[automatically_deny/prompt_for_credentials_on_the_secure_desktop/prompt_for_credentials]
(1) GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users
oval:org.secpod.oval:def:8787
SCAP Repo OVAL Definition
2013-01-21