Forum Discussion
Administrator Protection - Default Enabled?
We were in the same situation:
The Windows 11 25H2 Security Baseline has been deployed via GPO for some time, and Administrator Protection has been active since the October patch.
The relevant setting within the Security Baseline is:
"User Account Control: Configure type of Admin Approval Mode = Admin Approval Mode with Administrator protection"
This can be found under "Other" - not under "User Account Control" - which is why we didn't spot it right away.
"If your organization uses Windows security baselines, Administrator protection becomes enabled by default with the October 2026 Windows security update. The security baselines for Windows 11 that enable Administrator protection by default apply to versions 26H2, 25H2, and 24H2. "
Although this option “User Account Control: Configure type of Admin Approval Mode = Admin Approval Mode with Administrator protection” is not configured in the domain policies, the local secpol.msc indicates that this option is configured. This setting cannot be changed locally either, which is why I suspect it is automatically enabled by default; however, this must also trigger another policy setting in the baselines.
But that doesn’t matter now; we’ll leave Administrator Protection enabled and disable it selectively via GPP based on membership in a defined AD group.
