Administrator Protection - Default Enabled?

“Not configured” in the baseline doesn’t necessarily mean the feature is off. It means that baseline isn’t enforcing a value; another management source, a local setting, or a Windows default can still apply.

Before attributing this to another UAC setting, check the source of the change:

• Run gpresult /h report.html and check the effective computer policies, including local Group Policy.
• If the devices are Intune-managed, check Settings Catalog, Endpoint security > Account protection, and any custom OMA-URI profiles. Also check scripts and remediations that could write the registry value directly. Those won’t all appear in gpresult.
• Compare an affected device with one that hasn’t received the update, using the same policy assignments.

I can’t confirm from this information that the October update enabled Administrator Protection by default. The exact KB number and full OS build are needed to check that claim. If the value changes on a clean, unmanaged test machine after installing the same KB, that would be much stronger evidence of an update/default change.

Don’t assume setting the baseline to “Not configured” will undo an existing value. If you need a consistent result, explicitly configure the intended approval mode through the supported policy, rather than repeatedly changing the registry.