Administrator Protection recommended settings?

TairikuOkami · 2026-10-04T12:28:05-0400

Administrator Protection acts as a passkey, it lowers the overall security. It merely asks Yes/No, no WindowsHello/PIN.
It also allows lolbins, for example, you will get no admin prompt, when launching task manager, because it is "trusted".

win11freak said:
From the Group Policy settings, which one would be the more secure setting?

I prefer UAC at full with max restrictions:

Code:

rem =================================== Windows Policies ===================================
rem --------------------------------- User Account Control ---------------------------------

rem https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd835564(v=ws.10)
rem Reason to set UAC to Always Notify - https://learn.microsoft.com/en-us/previous-versions/technet-magazine/dd822916(v=msdn.10)
rem https://daniels-it-blog.blogspot.com/2020/07/uac-bypass-via-dll-hijacking-and-mock.html
rem https://www.bleepingcomputer.com/news/security/bypassing-windows-10-uac-with-mock-folders-and-dll-hijacking/
rem There are really only two effectively distinct settings for the UAC slider - https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105

rem 0 - Elevate without prompting / 1 - Prompt for credentials on the secure desktop / 2 - Prompt for consent on the secure desktop / 3 - Prompt for credentials / 4 - Prompt for consent / 5 (Default) - Prompt for consent for non-Windows binaries
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "1" /f

rem 0 - Automatically deny elevation requests / 1 - Prompt for credentials on the secure desktop / 3 (Default) - Prompt for credentials
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorUser" /t REG_DWORD /d "0" /f

rem 2 (Default)
rem reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableFullTrustStartupTasks" /t REG_DWORD /d "0" /f

rem Detect application installations and prompt for elevation / 1 - Enabled (default for home) / 0 - Disabled (default for enterprise)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableInstallerDetection" /t REG_DWORD /d "1" /f

rem Run all administrators in Admin Approval Mode / 0 - Disabled (UAC) / 1 - Enabled (UAC)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "1" /f

rem Only elevate UIAccess applications that are installed in secure locations / 0 - Disabled / 1 (Default) - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableSecureUIAPaths" /t REG_DWORD /d "1" /f

rem 0 (Default) = Disabled / 1 - Enabled
rem reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableUwpStartupTasks" /t REG_DWORD /d "0" /f

rem Allow UIAccess applications to prompt for elevation without using the secure desktop / 0 (Default) = Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableUIADesktopToggle" /t REG_DWORD /d "0" /f

rem https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/932a34b5-48e7-44c0-b6d2-a57aadef1799
rem 0 - Disabled / 1 - Enabled (Default)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableVirtualization" /t REG_DWORD /d "0" /f

rem 2 - Enable Administrator Protection for Admin Approval Mode / 1 - Disable
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "FilterAdministratorToken" /t REG_DWORD /d "1" /f

rem Allow UIAccess applications to prompt for elevation without using the secure desktop / 0 (Default) - Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "1" /f

rem Administrator Protection for Admin Approval Mode / 1 - Disable / 2 - Enable
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "TypeOfAdminApprovalMode" /t REG_DWORD /d "1" /f

rem Display highly detailed status messages / 0 (Default) - Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "VerboseStatus" /t REG_DWORD /d "1" /f

rem 1 - Enable command-line auditing
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v "ProcessCreationIncludeCmdLine_Enabled" /t REG_DWORD /d "1" /f



rem 1 - The device does not store the user's credentials for automatic sign-in after a Windows Update restart. The users' lock screen apps are not restarted after the system restarts.
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableAutomaticRestartSignOn" /t REG_DWORD /d "1" /f

rem Determines how many user account entries Windows saves in the logon cache on the local computer.
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "CachedLogonsCount" /t REG_DWORD /d "0" /f

rem 1 - Do not allow storage of passwords and credentials for network authentication in the Credential Manager
reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "DisableDomainCreds" /t REG_DWORD /d "1" /f

rem Digest Security Provider is disabled by default, but malware can enable it to recover the plain text passwords from the system’s memory (+CachedLogonsCount/+DisableDomainCreds/+DisableAutomaticRestartSignOn)
reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest" /v "Negotiate" /t REG_DWORD /d "0" /f
reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest" /v "UseLogonCredential" /t REG_DWORD /d "0" /f

BruceR · 2026-10-04T12:52:13-0400

TairikuOkami said:
Administrator Protection acts as a passkey, it lowers the overall security. It merely asks Yes/No, no WindowsHello/PIN.
It also allows lolbins, for example, you will get no admin prompt, when launching task manager, because it is "trusted".

Administrator Protection does not lower security. It increases it by requiring Windows Hello/PIN for every elevation, isolating the admin token, enforcing elevation policies, and eliminating silent elevations.

You have described classic UAC, not Administrator Protection.

See What’s Different with Administrator Protection

win11freak · 2026-10-04T14:24:21-0400

So which setting is preferred and more secure?

Prompt for Consent on the Secure Desktop Or Prompt for Credentials on the Secure Desktop?

Try3 · 2026-10-04T14:38:07-0400

TairikuOkami said:
Administrator Protection ... also allows lolbins, for example, you will get no admin prompt, when launching task manager, because it is "trusted".

Task manager requires a prompt [UAC prompt] on my Windows 11 computer [on which I have not enabled Admin protection].
Are you saying that Admin protection would stop that, in other words, Admin protection would cause Task mgr to be trusted so bypassing any prompt?

Denis

Try3 · 2026-10-04T14:43:16-0400

win11freak said:
Prompt for Consent on the Secure Desktop Or Prompt for Credentials on the Secure Desktop

Admin protection insists on a Credential prompt.
UAC allows for a Credential prompt to be enforced even for Admin accounts *** but, by default, allows a Consent prompt - which opens up the possibility of an intruder achieving Consent by forcing a Return key action whereas the intruder would not [at first] know the Admin account's password/PIN so would be stopped - so a Credential prompt is more secure.

*** see Change UAC Behavior for Administrators ElevenForumTutorials

Denis

pseymour · 2026-10-04T14:46:06-0400

Try3 said:
Task manager requires a prompt [UAC prompt] on my Windows 11 computer [on which I have not enabled Admin protection].
Are you saying that Admin protection would stop that, in other words, Admin protection would cause Task mgr to be trusted so bypassing any prompt?

Post #2 is totally incorrect.

Try3 · 2026-10-04T14:48:17-0400

pseymour said:
Post #2 is totally incorrect.

Good.
I would not want anything to be elevated automatically.

Denis

pseymour · 2026-10-04T14:54:13-0400

Yeah auto-elevation is basically removed, with the exception of the HKLM Run and RunOnce keys, but those keys are ACL'd so that only Admins and System can modify them.

win11freak · 2026-10-04T14:57:41-0400

The default setting from the link below is: Prompt for Credentials on the Secure Desktop.

LocalPoliciesSecurityOptions Policy CSP

Learn more about the LocalPoliciesSecurityOptions Area in Policy CSP.

learn.microsoft.com

pseymour · 2026-10-04T15:02:44-0400

win11freak said:
The default settings from my link below are: Prompt for Credentials on the Secure Desktop.

LocalPoliciesSecurityOptions Policy CSP

Learn more about the LocalPoliciesSecurityOptions Area in Policy CSP.

learn.microsoft.com

That's the way it should be, unless it's just too annoying to enter creds. I could see home users doing this for example, believing they are less of a target. But they're probably less likely to turn Admin Protection on in the first place, and they'll only be affected if the plan to make it the default comes to fruition.

Consent prompting was left as an option for just those kind of situations.

With Administrator protection, auto-elevation is removed. Users will notice an increase in consent prompts, though many fewer than the Vista days as much work has been done to clean up elevation points in most workflows. Additionally, users and administrators will have the option to configure elevation prompts as “credentialed” (biometric/password/PIN) via Windows Hello or simply confirmation prompts. This simple change trades some user convenience for a reduction in attack surface of roughly 92 auto-elevating COM interfaces, 11 DLL Hijacks, and 23 auto-elevating apps. Of the 79 known UAC bypasses tested, all but one are now fully or partially mitigated. The remaining open issue around token manipulation attacks has been assigned MSRC cases and will be addressed.

from : Evolving the Windows User Model – Introducing Administrator Protection | Microsoft Community Hub

Try3 · 2026-10-04T15:31:29-0400

pseymour said:
auto-elevation is basically removed

I have not been able to find an example of auto-elevation on my [still-UAC, Windows 11 Home] computers.
Do you know one? [I just want to be able to do before & after comparisons if I do set up Admin protection.]

Denis

pseymour · 2026-10-04T15:37:59-0400

Try3 said:
I have not been able to find an example of auto-elevation on my [still-UAC, Windows 11 Home] computers.
Do you know one? [I just want to be able to do before & after comparisons if I do set up Admin protection.]

You're going to have to give that a Goog yourself. I'm not going to mention any techniques on this forum, but they are well known and searchable.

Try3 · 2026-10-04T15:43:53-0400

I guess you're referring to malwares that manage to achieve elevation without a UAC prompt.
I never did find one that could get past UAC at its maximum level - but several claimed to be able to do so.

Thanks,
Denis

Administrator Protection recommended settings?

Microsoft 365 Basic

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer