Technology3 min read
Administrator Protection in Windows 11: how it differs from UAC
Microsoft is preparing to ship Administrator Protection for Windows 11: a regular user receives administrator rights only for a specific action and only after confirmation through Windows Hello. Here is how it differs from the familiar UAC and how to enable it.
How it works
The just-in-time principle: the session holds no standing administrative rights. When an application needs elevated privileges, the system asks for biometrics or a hardware key through Windows Hello, grants rights for one operation and takes them back. Malware that lands in the session cannot quietly elevate itself to administrator.
Rights on demand instead of standing rights is the principle we apply to contractor access on websites: grant for the task, revoke afterwards. Permanent admin access 'used once a year' eventually gets used by the wrong people.
How it differs from UAC
User Account Control shows a dialog that users have learned to confirm without reading, and elevation itself has long served as an attack vector. The new feature removes that vector: no elevation without biometric or hardware authentication, and rights do not linger in the session after approval.
Where it exists and how to enable it
The feature is included in update KB5120998 from August 2026 and in the Release Preview build KB5124006 (28000.3079); the full release is planned with Windows 11 26H2. It is off by default.
- Intune: a Settings Catalog entry or an OMA-URI parameter.
- CSP for third-party management systems.
- Group Policy for domain environments.
What to consider before enabling
Make sure Windows Hello is configured on every workstation: without it elevation becomes impossible. Review installers and service scripts that relied on silent elevation, and remote support scenarios. Enable on a pilot group first, then across the fleet.
Summary
Administrator Protection turns elevation from a habitual click into a deliberate identity check. For a corporate fleet it closes one of the oldest attack vectors, but requires Windows Hello preparation and a script review.
Sources
Follow the journal
New pieces on websites, SEO and AI come out in the QIO journal. Follow in Google, by RSS or in Telegram to get them first.
