Administrator protection in Windows 11: what it is and how to turn it on

Where it stands in November 2026

The feature has had a bumpy rollout, which is why older guides disagree:

• Microsoft announced it in November 2024 and tested it with Windows Insiders.
• It appeared as a preview in the October 2025 optional update, then was switched off in December 2025 while Microsoft fixed an app compatibility problem, according to a note on Google Project Zero’s research into it.
• It returned through the August 2026 preview update, and Microsoft’s message center and update notes describe it as generally available, off by default, from the September 22, 2026 preview update.
• In October 2026 Microsoft said its Windows security baseline turns it on for organizations that apply the baseline. Home PCs aren’t affected unless you turn it on.
• A bug that stopped non-admin users connecting by Remote Desktop (error 0xC000000D) after the September update was fixed in the October 28, 2026 update, according to Windows release health.

How it works

With normal UAC, Windows creates a full admin token for an administrator at sign-in and keeps it alongside a limited one; the prompt just asks before switching to it. According to Microsoft Learn, Administrator protection signs you in with a stripped-down token instead. When something needs admin rights, Windows authenticates you, usually with Windows Hello, and creates an admin token from a hidden, system-generated account kept separate from your profile. That token is given only to the app that asked and is destroyed when it closes.

Two practical effects follow. Windows no longer auto-elevates its own tools silently, so you’ll see more prompts. And elevated apps run in a separate profile, typically named ADMIN_ plus your user name, so their settings, mapped drives and signed-in sessions are separate from yours. Microsoft has described the feature as not a formal security boundary, though Microsoft has patched bypasses that researchers reported.

Should you turn it on?

It makes it harder for malware to quietly pick up admin rights, which is useful on a PC where you sign in as an administrator every day. Microsoft lists cases where it shouldn’t be enabled yet:

• PCs that need Hyper-V, including many developer setups.
• PCs whose local admin passwords are managed with LAPS.
• Windows 365 Cloud PCs and Azure Virtual Desktop session hosts.
• Setups with roaming profiles, or apps that share files between the normal and elevated profile.

Learn says it works on Windows 11 Home, Pro, Enterprise and Education, but not yet on Windows Server. If you rely on old apps that assume they always run as admin, test it before relying on it.

How to turn it on

Install the latest updates first through Settings > Windows Update. Each method needs a restart.

Option 1: Windows Security. Open Windows Security > Account protection (also reachable through Settings > Privacy & security > Windows Security). If you see Administrator protection, switch it on and restart. Microsoft still labels this toggle a preview and is rolling it out gradually, so it may not appear on your PC yet.

Option 2: Local Security Policy (Pro, Enterprise, Education). Press Win + R, run secpol.msc and open Local Policies > Security Options. Double-click User Account Control: Configure type of Admin Approval Mode, choose the option for Admin Approval Mode with Administrator protection, select OK and restart. The same setting is under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options in Group Policy. A second policy, User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection, controls what the prompt asks for.

Option 3: Registry (any edition). Guides on several sites use the policy’s registry value; Microsoft documents the policy rather than this value, so back up the registry first. In Command Prompt as administrator, run the command below and restart. To undo it, run it again with /d 1.

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v TypeOfAdminApprovalMode /t REG_DWORD /d 2 /f

For a refresher on opening admin tools, see how to open Command Prompt as administrator.

Check that it’s working

• Open an app with Run as administrator. You should get a Windows Hello or credential prompt rather than the usual Yes button.
• In that elevated window, run whoami. Users report it shows an account starting with ADMIN_ instead of your own name.
• Admins can log elevations: Learn lists event 15031 for approved and 15032 for denied elevations from the Microsoft-Windows-LUA provider.

Known problems and fixes

Microsoft’s own list of issues and workarounds includes:

Problem	What to do
Elevated app can’t see your mapped network drives	Copy the installer to a local folder first, or install in your normal user context.
App settings or sign-ins don’t carry over when elevated	Expected: the elevated profile is separate. Set the app up again there if needed.
WSL or Visual Studio environments missing when elevated	Set them up again in the elevated profile.
An app’s updater keeps failing	Run the update elevated, or turn the feature off temporarily.
No Start menu entry after installing an app	Fixed in the September 2026 update; install the latest updates.
Non-admin Remote Desktop sign-in fails with 0xC000000D	Fixed in the October 28, 2026 update.

If an app stops working with An administrator has blocked you from running this app, that’s a different protection; see what that message means. For Remote Desktop sign-in rights, see “To sign in remotely, you need the right to sign in”.

How to turn it off

Switch the toggle off in Windows Security > Account protection, or set User Account Control: Configure type of Admin Approval Mode back to the legacy (default) option in secpol.msc, or set the registry value to 1. Restart afterwards. On a work PC, the setting may come from your organization’s security baseline, so ask IT before changing it.

Related guides

• How to open Command Prompt as administrator in Windows 11 and 10
• An administrator has blocked you from running this app: what it means and safe fixes
• “To sign in remotely, you need the right to sign in through Remote Desktop Services”: fix
• Smart App Control blocked an app: what it means and what to do
• Remote Desktop error 0xC000000D: the token passed to the function is invalid (fix)

Official sources

• Administrator protection (Microsoft Learn)
• Windows 11, version 26H2 known issues and notifications (Windows release health)
• Windows message center (Windows release health)