On a Windows endpoint, someone may have disabled the secure desktop for elevation prompts by modifying a registry setting. Review the registry event logs to identify which registry value name was changed to 0.

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey == "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
| where RegistryValueName == "PromptOnSecureDesktop"
| where RegistryValueData == "0"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName

DeviceRegistryEvents | where RegistryValueData == '0' | summarize count() by RegistryValueName

DeviceRegistryEvents | where ActionType == 'RegistryValueSet' and RegistryValueData == '0' and RegistryKey contains 'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' | project DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData, TimeGenerated

DeviceRegistryEvents 
| where RegistryValueData =~ "0" 
| distinct RegistryValueName 
| order by RegistryValueName asc

DeviceRegistryEvents
| where RegistryValueData == "0"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine
| sort by TimeGenerated desc

let zeroRegex = @"(?i)^\s*(0|0x0+)\s*(\(\s*0\s*\))?\s*$";
DeviceRegistryEvents
| where ActionType in~ ("RegistryValueSet", "RegistryValueCreated")
// UAC policy path where PromptOnSecureDesktop resides
| where RegistryKey has @"\Microsoft\Windows\CurrentVersion\Policies\System"
      and RegistryKey has_any ("HKLM\\", "HKEY_LOCAL_MACHINE\\")
| extend IsZeroNow = tostring(RegistryValueData) matches regex zeroRegex,
         WasZeroBefore = iff(isnotempty(PreviousRegistryValueData) and tostring(PreviousRegistryValueData) matches regex zeroRegex, true, false)
| where IsZeroNow and (isempty(PreviousRegistryValueData) or WasZeroBefore == false)
// Optional: uncomment to focus strictly on the secure desktop setting
// | where RegistryValueName =~ "PromptOnSecureDesktop"
| project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueType,
          PreviousRegistryValueData, RegistryValueData,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has_cs "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
| where RegistryValueName in ("PromptOnSecureDesktop", "ConsentPromptBehaviorAdmin", "ConsentPromptBehaviorUser") or RegistryValueName has "PromptOnSecure"
| where tostring(RegistryValueData) has "0"
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessCommandLine, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueType, RegistryValueData, PreviousRegistryValueName, PreviousRegistryValueData, InitiatingProcessId, ReportId
| order by TimeGenerated desc

DeviceRegistryEvents
| where TimeGenerated between (startofday(now(-30d)) .. now())
// Accept multiple representations of 0: plain "0", hex "0x0", or numeric 0
| where RegistryValueData in ("0", "0x0") or toint(RegistryValueData) == 0
// Registry path filters: HKLM (Machine) or HKCU (User) policies System key
| where RegistryKey has_cs "Microsoft\\Windows\\CurrentVersion\\Policies\\System" or RegistryKey has_cs "CurrentVersion\\Policies\\System"
// Value name filters: known UAC related values and common substrings
| where RegistryValueName in ("PromptOnSecureDesktop", "ConsentPromptBehaviorAdmin", "ConsentPromptBehaviorUser", "EnableLUA", "EnableVirtualization")
    or RegistryValueName has_cs "Consent"
    or RegistryValueName has_cs "Prompt"
    or RegistryValueName has_cs "Secure"
// Show previous values if present to see what changed
| project TimeGenerated, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData, RegistryValueType, PreviousRegistryValueName, PreviousRegistryValueData, ReportId
| order by TimeGenerated desc
| take 500

DeviceRegistryEvents
| where TimeGenerated >= ago(1d)
| where ActionType in ("RegistryValueSet","RegistryValueUpdated","ValueSet","ValueChanged","SetValue")
| extend RegValInt = todouble(RegistryValueData)
| where isnotempty(RegistryValueName) and (isnotnull(RegValInt) and RegValInt == 0)
| project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueName, InitiatingProcessFileName, InitiatingProcessCreationTime
| sort by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey contains 'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System'
| where RegistryValueName == 'PromptOnSecureDesktop'
| where RegistryValueData == '0' or PreviousRegistryValueData == '0'
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData
| order by Timestamp desc

DeviceRegistryEvents
| where RegistryValueData == '0'
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
| order by TimeGenerated desc

DeviceRegistryEvents
| where ActionType in ("ModifyValue", "RegistryValueSet", "RegistryValueModified")
| where RegistryValueData == "0"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessAccountDomain
| order by TimeGenerated desc

DeviceRegistryEvents
| where ActionType in ("RegistryValueSet", "RegistryValueModified")
| where RegistryValueData == "0"
| project TimeGenerated, DeviceId, DeviceName, RegistryKey, RegistryValueName, RegistryValueData,
          InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

DeviceRegistryEvents
// --- The secure-desktop policy lives here ---
| where RegistryKey has "\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
// Focus on write operations
| where ActionType in~ ("SetValue", "RegistryValueSet", "ModifyValue", "Modification", "UpdatedValue")
// We care about values that were set TO 0
| where RegistryValueData == "0"
// If we have the previous value and it was already 0 we can ignore – we want real changes
| where isnull(PreviousRegistryValueData) or PreviousRegistryValueData !in ("0", "0x0")
// Limit to numeric types typically used for this policy (DWORD/QWORD) when the info is present
| where isnull(RegistryValueType) or RegistryValueType in~ ("REG_DWORD", "REG_QWORD", "dword", "qword")
// Add a friendly user column
| extend InitiatingUser = iif(isempty(InitiatingProcessAccountDomain), InitiatingProcessAccountName, strcat(InitiatingProcessAccountDomain, "\\", InitiatingProcessAccountName))
// Surface the interesting information
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData,
          InitiatingUser, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId, ReportId
// Summarise to answer the core question – which value names were set to 0 and where/when
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Devices=make_set(DeviceName, 10),
            Users=make_set(InitiatingUser, 10), ExampleProcesses=make_set(InitiatingProcessFileName, 10)
            by RegistryKey, RegistryValueName
| order by LastSeen desc

DeviceRegistryEvents
| where RegistryValueData == "0"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, ActionType
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryValueData == "0"
// Optionally filter for the specific registry key related to secure desktop elevation prompt
| where RegistryKey has "Policies\\System"
| where RegistryValueName == "PromptOnSecureDesktop"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
      or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System"
| where ActionType == "RegistryValueSet"
| where RegistryValueData == "0"
| project TimeGenerated,
          DeviceName,
          InitiatingProcessAccountDomain,
          InitiatingProcessAccountName,
          RegistryKey,
          RegistryValueName,
          RegistryValueType,
          RegistryValueData,
          PreviousRegistryValueData,
          InitiatingProcessCommandLine
| order by TimeGenerated desc