Forum Discussion
Administrator Protection - Default Enabled?
We are using the 25H2 Security Baselines. After the October 2026 Patch Tuesday, Administrator Protection is active, even though the setting “User Account Control: Configure type of Admin Approval Mode” is not set or configured in the 25H2 baselines or others Policies.
Which other setting is causing the registry value “TypeOfAdminApprovalMode” to be set to 2?
3 Replies
We were in the same situation:
The Windows 11 25H2 Security Baseline has been deployed via GPO for some time, and Administrator Protection has been active since the October patch.
The relevant setting within the Security Baseline is:
"User Account Control: Configure type of Admin Approval Mode = Admin Approval Mode with Administrator protection"
This can be found under "Other" - not under "User Account Control" - which is why we didn't spot it right away.
"If your organization uses Windows security baselines, Administrator protection becomes enabled by default with the October 2026 Windows security update. The security baselines for Windows 11 that enable Administrator protection by default apply to versions 26H2, 25H2, and 24H2. "Although this option “User Account Control: Configure type of Admin Approval Mode = Admin Approval Mode with Administrator protection” is not configured in the domain policies, the local secpol.msc indicates that this option is configured. This setting cannot be changed locally either, which is why I suspect it is automatically enabled by default; however, this must also trigger another policy setting in the baselines.
But that doesn’t matter now; we’ll leave Administrator Protection enabled and disable it selectively via GPP based on membership in a defined AD group.
“Not configured” in the baseline doesn’t necessarily mean the feature is off. It means that baseline isn’t enforcing a value; another management source, a local setting, or a Windows default can still apply.
Before attributing this to another UAC setting, check the source of the change:
- Run gpresult /h report.html and check the effective computer policies, including local Group Policy.
- If the devices are Intune-managed, check Settings Catalog, Endpoint security > Account protection, and any custom OMA-URI profiles. Also check scripts and remediations that could write the registry value directly. Those won’t all appear in gpresult.
- Compare an affected device with one that hasn’t received the update, using the same policy assignments.
I can’t confirm from this information that the October update enabled Administrator Protection by default. The exact KB number and full OS build are needed to check that claim. If the value changes on a clean, unmanaged test machine after installing the same KB, that would be much stronger evidence of an update/default change.
Don’t assume setting the baseline to “Not configured” will undo an existing value. If you need a consistent result, explicitly configure the intended approval mode through the supported policy, rather than repeatedly changing the registry.
