What is Windows Administrator Protection?

Windows Administrator Protection is a security feature designed to enhance the security of Windows systems by managing and controlling administrative privileges. This feature ensures that users operate with the least privilege necessary, reducing the risk of unauthorized changes and malware attacks. It requires users to verify their identity with Windows Hello before performing actions that require administrative privileges, such as installing software, changing system settings, or accessing sensitive data. Windows Administrator Protection is a new security feature introduced in Windows 11. It is currently available in preview for Windows Insiders and will become a default setting in future Windows 11 updates.
Windows Security

Why Should You Configure Windows Administrator Protection?

Configuring Windows Administrator Protection is crucial for several reasons:

  1. Enhanced Security: By requiring explicit authorization for administrative tasks, it prevents unauthorized changes and helps protect against malware that relies on admin privileges to execute harmful actions.
  2. User Control: It allows users to manage admin rights, granting or restricting access to individual apps, ensuring that only authorized applications can make system changes.
  3. Malware Reduction: It breaks the attack chain by preventing malware from silently acquiring admin privileges, thus reducing the risk of system compromise.

How to Set Up Windows Administrator Protection

Using Windows Security Settings

  1. Open Windows Security: Go to the Start menu, type “Windows Security,” and open the app.
  2. Navigate to Account Protection: In the Windows Security app, click on “Account protection.”
  3. Enable Administrator Protection: Find the option for Administrator Protection and switch the toggle to “On.” A restart will be required to apply the changes.

Using Group Policy

  1. Open Group Policy Editor: Press Win + R, type gpedit.msc, and press Enter.
  2. Navigate to Security Options: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
  3. Configure Admin Approval Mode: Find the policy “User Account Control: Configure type of Admin Approval Mode” and set it to “Admin Approval Mode with Administrator Protection.”
  4. Set Prompt Behavior: Adjust the policy “User Account Control: Behavior of the elevation prompt for administrators running with Administrator Protection” to your desired setting, typically “Prompt for credentials.”
  5. Restart the Device: Apply the changes by restarting your computer.
    Windows Administrator Protection

Using Microsoft Intune

  1. Create a Security Group: In Intune, create a security group and enroll your users in that group.
  2. Set Up the Policy: Use the settings catalog or administrative templates in Intune to configure the Administrator Protection policy.
  3. Apply the Policy: Include your security group in the policy and let Intune sync to apply the settings.
  4. Restart Devices: Ensure that devices are restarted to enable the feature.
    Windows Administrator Protection

By following these steps, you can effectively set up Windows Administrator Protection, enhancing the security of your Windows environment and ensuring that administrative privileges are managed securely and efficiently.

 

Paul Cobben