Microsoft
Community ManagerSorry, but the answer in the video didn't address the question.
For those who haven't seen the video, Abhijat says, in sumary, "You're still a member of administrators, and you still have an admin token and it's discarded so it's safe". There's nothing about how you're supposed to successfully elevate.
If I am supporting someone remotely, and this is the first time I'm helping them, using my personal admin account, how can I possibly satisfy a Windows Hello challenge? The user is signed in as a standard user, I've connected via Remote Help or maybe another remote access program (seriously, you've blocked mention of a rival app!???). I want to uninstall a program which requires that I elevate.
When I do that, based on what I read above, I'm prompted for Windows Hello. I've never seen that device. I don't have a Hello PIN. I'm 2500km away so getting my face on their camera is *quite* difficult, and my arms just aren't long enough to enroll and verify a fingerprint.
You can't possibly be thinking that every admin will be enrolled in Hello on every device, nor that every user will be a local admin, so ... what are we missing here?
MicrosoftAdministrator protection is for protecting the admin users on Windows devices. If you are logging in remotely with RDP, Administrator protection will work for you.
If you are looking at managing standard users, we would recommend using EndPoint Privilege Management. More here: Learn about using Endpoint Privilege Management with Microsoft Intune | Microsoft Learn
This doesn't seem to answer the question. For example, how would this work with LAPS accounts? The LAPS account would not have any local Windows Hello info, and it cannot be assumed that the connection would be via RDP as the LAPS account.
This doesn't seem to answer the question. For example, how does this work with LAPS local admin accounts? The LAPS account will not have any local Windows Hello info, nor can it be assumed that the connection method would be an RDP connection made as the LAPS account.
