MicrosoftHello, how does 'admin protection' work if you remote into a users laptop. The user is working from home and you as IT support need to use a domain admin account on the remote computer e.g. need to remove some faulty software.
Community ManagerSorry, but the answer in the video didn't address the question.
For those who haven't seen the video, Abhijat says, in sumary, "You're still a member of administrators, and you still have an admin token and it's discarded so it's safe". There's nothing about how you're supposed to successfully elevate.
If I am supporting someone remotely, and this is the first time I'm helping them, using my personal admin account, how can I possibly satisfy a Windows Hello challenge? The user is signed in as a standard user, I've connected via Remote Help or maybe another remote access program (seriously, you've blocked mention of a rival app!???). I want to uninstall a program which requires that I elevate.
When I do that, based on what I read above, I'm prompted for Windows Hello. I've never seen that device. I don't have a Hello PIN. I'm 2500km away so getting my face on their camera is *quite* difficult, and my arms just aren't long enough to enroll and verify a fingerprint.
You can't possibly be thinking that every admin will be enrolled in Hello on every device, nor that every user will be a local admin, so ... what are we missing here?
MicrosoftAdministrator protection is for protecting the admin users on Windows devices. If you are logging in remotely with RDP, Administrator protection will work for you.
If you are looking at managing standard users, we would recommend using EndPoint Privilege Management. More here: Learn about using Endpoint Privilege Management with Microsoft Intune | Microsoft Learn
