Solved Is the Administrator protection FINALLY has been rolled out? Take a look from the images.

Try3 · Tuesday at 11:49 AM

win11freak said:
ADMIN_username profile

ADMIN_username account exists temporarily only whilst the relevant elevated task is running.
It is separate from your username account.
So it won't contain the folders-files of your username account or respond to your username account password.

Denis

pseymour · Tuesday at 12:45 PM

win11freak said:
I am running with my local Admin account and what would happen if I open the ADMIN_username profile folder using my Admin Protection credentials? Because when I try to open the ADMIN_username profile folder, it says that I currently do not have Permission to open it unless of course I enter my credentials.

Would I see the same folder and file structure the same way as with my own local Admin User profile folder?

You can browse the contents of the ADMIN_ profile if you want, but it's a regular user profile, just like your real user account's profile. It would almost have to be a normal profile by necessity, so that any processes running under that account would have access to a Desktop, Documents, temp, etc. For example, if some process running under that account says, "I want to write a file to %TEMP%," it goes in the ADMIN_ account's profile, not yours.

It does still exist after the process closes, but there's nothing Earth-shattering in there.

win11freak · Tuesday at 1:16 PM

So would it be fine to open the ADMIN_user profile folder without causing any security related issues to the Admin Protection feature?

garlin · Tuesday at 1:23 PM

What's with the obsession? It's a "dummy account" created purely for sandboxing the token granting process, so it's distinct from your normal identity.

While MS could have created the absolute minimum of folders (like skipping "Music", etc.), it's easier to re-use existing Windows code to create a normal user profile instead of the security team writing their own from scratch.

pseymour · Tuesday at 1:29 PM

win11freak said:
So would it be fine to open the ADMIN_user profile folder without causing any security related issues to the Admin Protection feature?

Yeah, if you want to, but I don’t know why you would unless you were looking for a file that got saved there or something.

win11freak · Tuesday at 5:22 PM

pseymour said:
Yeah, if you want to, but I don’t know why you would unless you were looking for a file that got saved there or something.

If files are actually getting saved there, I don't think its a wise idea. Because the whole point I would think that this ADMIN profile folder can't be touched by malware or even a legitimate file. Because what if malware gets into this ADMIN profile folder then this Administrator Protection wouldn't do no protecting at all. No files should be added in there manually or automatically in that folder.

I thought the whole point of the Administrator Protection was that when a local Admin user account elevates when making system changes or installing applications, then the Administrator Protection creates a temporary Admin token and that temporary Admin token then gets destroyed after the elevation ends along with the ADMIN profile folder.

pseymour · Tuesday at 5:59 PM

win11freak said:
If files are actually getting saved there, I don't think its a wise idea. Because the whole point I would think that this ADMIN profile folder can't be touched by malware or even a legitimate file. Because what if malware gets into this ADMIN profile folder then this Administrator Protection wouldn't do no protecting at all. No files should be added in there manually or automatically in that folder.

I thought the whole point was that when a local Admin user account elevates when making system changes or installing applications, then the Administrator Protection creates a temporary Admin token and that temporary Admin token then gets destroyed after the elevation ends along with the ADMIN profile folder.

Sure, no files should be saved there. But you might have some dumb app that automatically saves to the Documents folder, without asking, for example. That's why this stuff needs to be thoroughly tested in whatever your environment is. You don't see that much anymore like we did in the 90's and 00's, but it still happens.

But no, the admin token goes away, but the profile remains. It should be protected such that only an admin account can get in there, so that's good. I actually haven't checked the ACLs on the ADMIN_ account's folder though.

Edit: Yep, the ACLs say System, Administrators, and the ADMIN_ account itself have full control.

win11freak · Wednesday at 1:00 AM

pseymour said:
Sure, no files should be saved there. But you might have some dumb app that automatically saves to the Documents folder, without asking, for example. That's why this stuff needs to be thoroughly tested in whatever your environment is. You don't see that much anymore like we did in the 90's and 00's, but it still happens.

But no, the admin token goes away, but the profile remains. It should be protected such that only an admin account can get in there, so that's good. I actually haven't checked the ACLs on the ADMIN_ account's folder though.

Edit: Yep, the ACLs say System, Administrators, and the ADMIN_ account itself have full control.

I checked the ACLs using this PowerShell Command below for the ADMIN_Profile folder and my output was the same:

(Get-Acl -Path "C:\Users\YourUsername").Access | Format-Table IdentityReference, FileSystemRights, AccessControlType, IsInherited -AutoSize

NT AUTHORITY\SYSTEM
BUILTIN\Administrators
PC Name\ADMIN_account
Account Unknown S-1-15-3-

What is this Account Unknown used for?
Should I remove it?

Morph000 · Wednesday at 1:53 AM

Well, it's simple.
Microsludge don't want people messing with Windows, because every problem the user creates becomes one the community gets pestered about and has to (attempt to) solve. Sludge doesn't have the time, resources and staff to devote to fixing problems that wouldn't exist if people didn't mess with the OS.
They're going down the Mac path - just use it, you don't need to know how it works and you don't need to mess with it.
The whole point of an administrator is to appoint someone with the expertise who's competent to make changes. Admin protection just insults said admins.

pseymour · Wednesday at 6:22 AM

win11freak said:
Account Unknown S-1-15-3-

What is this Account Unknown used for?
Should I remove it?

It's a capability SID. Don't remove it.

Try3 · Wednesday at 7:02 AM

If you are sufficiently interested, you can read a bit about Capability SIDs in
Well-known security identifiers - MSSupport

Denis

Try3 · Wednesday at 7:05 AM

Morph000 said:
Admin protection just insults said admins

It protects their systems against unauthorised intrusion.

Denis

colinp · Wednesday at 9:14 AM

I can't leave well enough alone, so I enabled administrator protection. I didn't see any smoke yet and it just asks me to input my PIN, instead of click yes. Next up - try sudo.

win11freak · 2026-10-09T14:05:38-0400

Since I am running as a local Admin account and need to install or make system changes when Administrator Protection is turned on, do I still need to right click and select Run as Administrator?

pseymour · 2026-10-09T14:49:39-0400

Yes, if you want the thing to run as administrator, unless the executable is marked to require admin rights (with the little UAC shield).

For executables not marked this way, for example PowerShell, if you want it to have admin rights, you need to run it that way. If you want it to run as a normal user, no.

win11freak · 2026-10-09T17:25:23-0400

pseymour said:
Yes, if you want the thing to run as administrator, unless the executable is marked to require admin rights (with the little UAC shield).

View attachment 186050

For executables not marked this way, for example PowerShell, if you want it to have admin rights, you need to run it that way. If you want it to run as a normal user, no.

I did not know this.

So for example, if I need to make changes to a Group Policy setting even if Administrator Protection is turned on, then I need to right click on GPEDIT.MSC and select RunAs Administrator?

Don't seem to make much sense because despite opening GPEDIT.MSC without using the RunAs Administrator option, it still does require me to enter my Admin Windows Hello PIN or my password.

Really confusing.

Solved Is the Administrator protection FINALLY has been rolled out? Take a look from the images.

Well-known member

My Computer My Computer

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer