Administrator protection

Administrator protection is a platform security feature in Windows 11 designed to ensure users run with the least privilege needed, elevating to admin rights only when necessary and only with the user's explicit approval. This feature operates on the principle of least privilege, keeping users in a deprivileged state and granting just-in-time elevation rights only when needed.

In today's digital landscape, users with Administrator rights on Windows have powerful capabilities to modify configurations and make system-wide changes that might affect the overall security posture of a Windows 11 device. Administrative privileges create a significant attack vector. Malicious actors often exploit these privileges to gain unauthorized access to user data, compromise privacy, and disable OS security features without the user’s knowledge.

Administrator protection addresses this challenge by requiring users to verify their identity with Windows Hello integrated authentication. It enforces this verification before allowing actions that need administrator privileges, such as installing software, changing system settings like the time or registry, and accessing sensitive data.

Benefits

Administrator protection provides several key benefits:

  • Enhanced security: By requiring explicit authorization from the user for every administrative task, Administrator protection protects Windows from accidental changes by users and changes by malware. It helps ensure that users are aware of potentially harmful actions before they occur, providing an extra layer of defense against threats.

  • User control: Administrator protection requires users to decide explicitly whether they want a particular application to run as elevated. This helps ensure that only authorized apps can make system changes, reducing the risk of accidental or malicious modifications.

  • Malware reduction: Malicious software often relies on admin privileges to change device settings and execute harmful actions. Administrator protection breaks the attack kill chain since malware can no longer silently acquire admin privileges.

System requirements

Administrator protection is now available with KB5120998. The feature is off by default. Enterprise customers can enable the feature using custom OMA-URI.

Supported editions: Windows 11 Home, Pro, Enterprise, Education.

Administrator protection currently applies to supported Windows 11 devices outside Windows 365 Cloud PCs and Azure Virtual Desktop session hosts. Support for these environments, as well as Windows Server editions, is planned for a future release.

For Windows 365 and Azure Virtual Desktop session hosts, configure users as standard users to follow least-privilege best practices.

How Administrator protection works

At its core, Administrator protection operates on the principle of least privilege. When a user signs in to Windows, they receive a deprivileged user token. However, when admin privileges are needed, Windows requests that the user authorize the operation. Once authorized, Windows uses a hidden, system-generated, profile-separated user account to create an isolated admin token. This token is issued to the requesting process and is destroyed once the process ends, ensuring that admin privileges don't persist. The architectural changes ensure that no one can access or tamper with the code or data of elevated sessions without proper authorization.

Some applications might rely on admin rights always being present, and the elevated profile being accessible when running unelevated. With this new approach, some scenarios in those apps might need updates to work smoothly with the enhanced security model. Microsoft is actively collaborating with app developers to help them adapt, ensuring your favorite experiences remain seamless while keeping your system protected. For guidance on developing your applications, see Enhance your application security with administrator protection.

Ultimately, these changes are all about making Windows more secure for you, so you can enjoy powerful features with greater peace of mind.

Key architectural highlights

Diagram of the administrator protection architecture.

  • Just-in-time elevation: Users stay deprivileged and are granted just-in-time elevation rights only during an admin operation. The admin token is discarded after use and recreated when another task requiring admin privileges is performed.

  • Profile separation: Administrator protection uses hidden, system-generated, profile-separated user accounts to create isolated admin tokens. This helps ensure that user-level malware can't compromise the elevated session.

  • No auto-elevations: Users need to interactively authorize every admin operation. This ensures that the administrator user stays in full control and that admin privileges aren't abused.

  • Windows Hello integration: Administrator protection is integrated with Windows Hello for simple and secure authorization.

Configuration

You can enable administrator protection through several methods:

  • Microsoft Intune Settings Catalog (Preview)
  • CSP
  • Group policy
  • Windows Security Settings (Preview)

Note

To configure devices by using Microsoft Intune, create a Settings catalog policy, and use the settings listed under the category Local Policies Security Options:

  • User Account Control Behavior Of the Elevation Prompt for Administrator Protection
    • User Account Control Type Of Admin Approval Mode

Assign the policy to a security group that contains as members the devices or users that you want to configure.

Important

A reboot is required for Administrator Protection to take effect.

Monitoring and Reporting Events

To track elevations, administrator protection has two new Event Tracing for Windows (ETW) events under the existing Microsoft-Windows-LUA provider with GUID {93c05d69-51a3-485e-877f-1806a8731346}:

Event ID Event Name Description
15031 Elevation Approved Logged when a user successfully authenticates and elevation is granted
15032 Elevation Denied/Fail Logged when elevation is denied, fails, or times out

What gets logged

  • The Security Identifier (SID) of the user who triggered the elevation
  • The application name and path
  • The elevation outcome (approved, denied, timeout)
  • The system managed admin account used to perform the task
  • The authentication method (e.g., password, PIN, Windows Hello)

How to capture these events

  • Enable the Microsoft-Windows-LUA provider (GUID: {93c05d69-51a3-485e-877f-1806a8731346})
  • Use Logman or WPR (Windows Performance Recorder) to start a trace session
  • Filter for Event IDs 15031 and 15032
  • Analyze the resulting .etl file using Windows Performance Analyzer or your preferred tool

Here’s a sample command:

logman start AdminProtectionTrace -p {93c05d69-51a3-485e-877f-1806a8731346} -ets

Troubleshooting

Note

When not to enable this feature:

  • Windows 365 Cloud PCs. Enterprise and Flex, Business.
  • Azure Virtual Desktop session hosts
  • For devices that require Hyper-V or Windows Subsystem for Linux (WSL).
  • If you're using apps that can’t access Edge extensions or shared files across profiles. For example: Some installers (using WebView2 internally) may request elevated permissions even when launched normally showing “Microsoft Edge can't read and write to its data directory”.

  • Use local SYSTEM or dedicated service accounts for scheduled tasks or scripts set to run “with highest privileges”. Essentially, redesign scripts to avoid expecting an always-on admin token. Any workflow that assumed an admin session is available will need to be adjusted.

  • When apps run elevated with administrator protection, Single Sign-On (SSO) credentials from the standard session aren't available to the elevated session. Any domain or cloud authentication must be re-established within that elevated session.

  • Network Drives/Resources Inaccessible from elevated apps. Install it in user context to enable network credential prompts. If it's essential to install an application as elevated, copy installation files to a local drive before elevating.

  • Settings data for applications don't carry over across the regular(unelevated) and the elevated profiles. Only elevate apps you truly need to. Consider configuring those applications to use common data directories accessible to both profiles (if possible).

  • Remote logon on Windows 365 Cloud PC and Azure Virtual Desktop session hosts, roaming profiles, and backup admins aren't supported.

  • For cross-machine remote administration scenarios, remote elevation behavior can be controlled by the User Account Control: Allow remote logon with elevated privileges for domain users in the local Administrators group when Administrator protection is enabled policy.

    Behavior:

    • Disabled (Default): Domain users in the local Administrators group perform remote logons without elevated privileges.
    • Enabled: Domain users in the local Administrators group perform remote logons with elevated privileges, matching traditional UAC behavior.

    For more granular control, use the User Account Control: Allow remote logon with elevated privileges for specified domain users and groups when Administrator protection is enabled policy to grant elevated remote logons only to designated domain users or groups while keeping others non-elevated.

  • A few applications don't show the launch icon in the start menu after installation. If you have installed elevated, you need to navigate manually to installation location: AppData\Roaming\Microsoft\Windows\Start Menu\Programs\<App name>

  • If updating any of your applications is blocked, temporarily disable the feature. (Reboot is needed).

  • Last updated on