Windows 11: Administrator protection enabled by default in security baseline since October 2026

Summary

If your organization uses Windows security baselines, Administrator protection became enabled by default with the October 2026 Windows security update. This applies to Windows 11 versions 26H2, 25H2 and 24H2. Microsoft recommends reviewing and testing the baseline configuration.

What changes?

Administrator protection makes users run with least privilege and elevate to admin rights only with explicit approval. On systems using the baseline, elevation behaviour changes, which may affect software, scripts or admin tools that assume implicit administrator rights.

Affected

• Windows 11 versions 26H2, 25H2 and 24H2
• Organizations that apply the Windows 11 security baselines

Preparation and temporary exceptions

1. Review and test your security baseline configuration.
2. Adjust it for your environment using Microsoft Intune or Group Policy.
3. Check these policies: "User Account Control: Configure type of Admin Approval Mode" and "User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection".

Check and complete

Not a defect. The change is intended; the behaviour is controlled via the policies named above.

Recommendation

Test the baseline on a pilot group, check admin tools and installers for elevation problems, and set the two UAC policies deliberately before rolling out the October 2026 update broadly.

Sources

• Manage Administrator protection within Windows 11 security baseline Vendor · learn.microsoft.com
• Windows 11 version 26H2 security baseline Vendor · techcommunity.microsoft.com

Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 17:04.