Administrator protection is coming on by default. Test it before it tests you

Administrator protection is one of the best security changes Windows 11 has had in years. It's also now switched on by default for anyone using Microsoft's Windows security baselines, as of the October 2026 security update. If you apply those baselines through Intune and haven't tested it, now is the time, because it changes how admin rights work on every device it touches.

What administrator protection does

For years, an admin account on Windows has carried its admin rights around all day, with User Account Control (UAC) asking "are you sure?" now and then. Malware that runs as that user has a short path to full control of the machine.

Administrator protection changes the model. According to Microsoft's documentation:

When you sign in, you get a standard, deprivileged token, even if you're a local admin.
When something needs admin rights, Windows asks you to approve it, using Windows Hello, a PIN or a password.
Once you approve, Windows creates the admin token from a hidden, system-managed account with its own separate profile. The token belongs to that one process and is destroyed when the process ends.
There is no auto-elevation. Every admin action needs you to approve it.

The point is that malware running as you can't quietly pick up admin rights. It has to get you to approve a prompt, and that prompt now needs Windows Hello or your credentials rather than a single click.

Why this matters now

On its own, the feature is off by default. But Microsoft's documentation says that if your organisation uses Windows security baselines, administrator protection is enabled by default with the October 2026 Windows security update. The baselines for Windows 11 26H2, 25H2 and 24H2 include the new defaults. Microsoft's advice is to review and test your configuration before the update reaches devices.

If you deploy security baselines from Intune and accept the new version without reading the change list, administrator protection may already be live on your devices.

What can break

Microsoft's own page has a frank list of places where administrator protection shouldn't be used, or where it changes behaviour. The ones most likely to catch out a support desk:

Remote Desktop. Microsoft lists a known issue where non-admin users can't connect over Remote Desktop, with error 0xC000000D, after installing KB5124010 or later updates. BleepingComputer reported that this mainly affects enterprise-managed devices used as Remote Desktop hosts. The temporary workaround is to turn administrator protection off on those devices by resetting the User Account Control Type Of Admin Approval Mode policy in Intune or Group Policy.
LAPS. Microsoft says not to enable it on devices managed with Local Administrator Password Solution. If you've rolled out Windows LAPS, plan carefully before you let the baseline switch this on.
Cloud PCs and session hosts. It isn't supported on Windows 365 Cloud PCs or Azure Virtual Desktop session hosts, and it isn't available on Windows Server.
Hyper-V. Microsoft lists devices that need Hyper-V among those not to enable it on.
Network drives. Elevated apps can't reach network drives. If an installer lives on a file share, copy it to a local drive first or install it in the user context.
Single sign-on. Credentials from the normal session aren't passed to elevated apps, so an elevated app may ask the user to sign in again.
Separate profile. Settings don't carry over between the normal and elevated profiles. Tools like WSL or Visual Studio that need elevation for some tasks have to be set up separately in the elevated profile.

How I'd handle it

This is a feature you want, so the aim is to roll it out on purpose rather than turn it off and forget about it.

Find out where it's already on. In the Intune admin centre, check which security baseline versions are assigned and whether the new defaults are included. Then check your Settings catalog policies under Local Policies Security Options for User Account Control Type Of Admin Approval Mode.
Exclude the devices it doesn't suit. Remote Desktop hosts, Hyper-V machines, Cloud PCs, session hosts and LAPS-managed devices need a decision before the feature reaches them, not after.
Pilot it. Pick a small group of IT staff and a few willing users. Note which apps prompt, which fail and which need reinstalling in the elevated profile.
Brief the service desk. The new prompt looks different, and "it asked me for my PIN to install something" will become a common ticket. A short note saves a lot of confused calls.
Remember a reboot is needed. Microsoft says devices must restart before administrator protection takes effect, so a policy change won't show up straight away.

If you need evidence of who elevated what, Microsoft documents two new events under the Microsoft-Windows-LUA provider: 15031 for an approved elevation and 15032 for a denied or failed one.

The bottom line

Administrator protection closes one of the oldest gaps in Windows: admin rights that sit there all day waiting to be abused. The catch is that it's arriving quietly through baselines. Read the baseline change list, decide which devices should be excluded, pilot it, and then let it do its job.

Sources

← All posts