Solved Still no Administrator protection on 25h2?

NormanF · Oct 12, 2025

I haven't tried it but if you don't receive a PIN prompt, I guess we'll have to wait for Microsoft to issue a fix.

fg2001gf11F · Oct 12, 2025

NormanF said:
I haven't tried it but if you don't receive a PIN prompt, I guess we'll have to wait for Microsoft to issue a fix.

Yes, MS has still a bug.

It is not asking for the PIN, regardless of how many times I turn it off and reboot and turn it back on and reboot.
That is why MS is not rolling it out yet.
Same behavior problem on R.P. 26200.6725, Beta 26120.6780, Dev 26220.6780 and Public Build 26200.6725.

Edition Windows 11 Pro
Version 25H2
Installed on ‎9/‎12/‎2025
OS build 26220.6780
Experience Windows Feature Experience Pack 1000.26100.262.0

Bradavon · Oct 14, 2025

kelper said:
It only works when you log in with an Admin account. As I normally use a 'user account', it offers no extra protection for ME

Thanks for this.

I keep reading articles how to enable it in GPEDIT and the Registry but it's already enabled for me. I never set it. But nothing new happens when I do an Admin task and I don't have it in Windows Security on 24H2.

It sounds like it's not been fully rolled out yet, as most people don't run Windows logged in as an Admin account in general and you need to be on the right Windows 11 builds too.

Try3 said:
I agree with the others. It has yet to be introduced.

You might like to join in the discussion at
Enable or Disable Administrator Protection - ElevenForumTutorials

This is the only article I can find that's correct.

I've read a few AP articles on the web and none say you currently need specific Windows 11 Builds to be installed first.

Since Vista it's always struck me as plain odd you just need to click YES on UAC prompts. I appreciate the goal back in 2007 (and 2009 with the Win 7 UAC version) was to put the onus on the user to confirm they want to do an Admin task, but most non-technical users are just going to click YES aren't they.

Admin Protection on paper seems like the MacOS approach where you're prompted for your credentials, as it always should've been. I've not read through all the ins and out of AP yet.

fg2001gf11F · Oct 14, 2025

Bradavon said:
Thanks for this.

I keep reading articles how to enable it in GPEDIT and the Registry but it's already enabled for me. I never set it. But nothing new happens when I do an Admin task and I don't have it in Windows Security on 24H2.

It sounds like it's not been fully rolled out yet, as most people don't run Windows logged in as an Admin account in general and you need to be on the right Windows 11 builds too.

This is the only article I can find that's correct.

I've read a few AP articles on the web and none say you currently need specific Windows 11 Builds to be installed first.

Since Vista it's always struck me as plain odd you just need to click YES on UAC prompts. I appreciate the goal back in 2007 (and 2009 with the Win 7 UAC version) was to put the onus on the user to confirm they want to do an Admin task, but most non-technical users are just going to click YES aren't they.

Admin Protection on paper seems like the MacOS approach where you're prompted for your credentials, as it always should've been. I've not read through all the ins and out of AP yet.

It used to work on Dev and Beta, but not anymore.
Even when it is enabled in settings it is not asking for the PIN or any credentials.

pseymour · Oct 14, 2025

Bradavon said:
Admin Protection on paper seems like the MacOS approach where you're prompted for your credentials, as it always should've been. I've not read through all the ins and out of AP yet.

You can set UAC to prompt for credentials; it just isn't set that way by default for administrators. The added perk of Admin Protection is that it creates a new account on the fly, separating the admin permissions into an account that is destined to be deleted.

Bradavon · Oct 14, 2025

pseymour said:
You can set UAC to prompt for credentials; it just isn't set that way by default for administrators.

Yeah of course you can. I've not messed with UAC for years so forgot you even could set it this way.

I suspect it's not default for consumers anyway, as Microsoft got so much bad rap when Vista was released they've not dared. The feature you speak about is utilised in Business environments.

And actually thinking about it, it's not often I see the UAC prompts anyway. Generally, for particular apps. So doubt I'd even mind creating a need to enter my password.

UAC only lets you enter a password and not biometric authentication that's now in Windows. My Mum doesn't even know her PC's password, she's so used to entering the Pin.

Even though I just said what I did, I thought about enabling it years ago but decided not to, partially because I didn't want to be running two accounts on my/family PCs.

I believe it's slightly different from MacOS which just prompts you for your login password when you do an Admin task. UAC asking for Admin credentials is a separate admin password to your regular Standard User password you're logged into Windows as.

Current me if I'm wrong here. Thanks.

pseymour said:
You can set UAC to prompt for credentials; it just isn't set that way by default for administrators. The added perk of Admin Protection is that it creates a new account on the fly, separating the admin permissions into an account that is destined to be deleted.

Oh nice thanks for this update. That sounds good.

It sounds like, when it works, this is designed to be seamless, and you don't visually see temporarily an Admin account is created?

It sounded like something I'd enable on my/family PCs when I read the article. It'll come to the RTM builds one day.

pseymour · Oct 14, 2025

Bradavon said:
The feature you speak about is utilised in Business environments.

Yep, I know.

Bradavon said:
UAC asking for Admin credentials is a separate admin password to your regular Standard User password you're logged into Windows as.

Depends. You can have two separate accounts, and enter the admin's credentials from the user's desktop. Alternatively, you can log in with the admin and be prompted for creds when you do admin things. However you want to set it up.

Bradavon said:
you don't visually see temporality an Admin account is created?

Not unless you go looking for it, e.g., opening a command prompt as admin and running whoami.

Bradavon · Oct 15, 2025

pseymour said:
Yep, I know.

I said that more as a reminder to myself

I work in Application Support and had my own Admin account for years, but now the IT Admin department have taken away my Admin account for no particularly good reason, and I need to waste their time to install Apps for me to test different versions. I've been using Windows since I was 14. I know what an Admin account is

.

pseymour said:
Not unless you go looking for it, e.g., opening a command prompt as admin and running whoami.

Good point. This would tell you.

Thanks.

kelper · Oct 15, 2025

Bradavon said:
It sounds like it's not been fully rolled out yet, as most people don't run Windows logged in as an Admin account in general and you need to be on the right Windows 11 builds too.

Most people use only one account which is an admin one. Very few people have two accounts.

Bradavon · Oct 15, 2025

kelper said:
Most people use only one account which is an admin one. Very few people have two accounts.

Oh really. Personally, I wouldn't want to be permanently logged in as Admin. It circumvents the need for UAC.

Thanks for the info.

fg2001gf11F · Oct 30, 2025

I tried Administrator Protection with Build 26200.7019 and also with Canary Build 27975.984.
It now needs all these 3 IDs to be enabled, 45172197,51406324,57048231.

The red message asking to restart is now working properly on Canary 27975.984. The red message shows once when the switch is toggled On or Off and goes away after restart is done.
With 26200.7019 when the switch is On, it keeps showing the red message even after a restart is done, they still need the same fix that was added on Canary.

The red message should show once after the switch is toggled On or Off and get cleared after one restart.

call4cloud · Nov 1, 2025

If i enable the above and feature ids with the stagingtool/vivetool ... well it works :)

garlin · Nov 1, 2025

Confirmed:

https://twitter.com/x/status/1983792332534378525

NormanF · Nov 1, 2025

The issue was fixed and now when I attempt to run an app requesting elevated privilege, a PIN prompt appears.

win11freak · Nov 5, 2025

Still

fg2001gf11F said:
Yes, MS has still a bug.
It is not asking for the PIN, regardless of how many times I turn it off and reboot and turn it back on and reboot.
That is why MS is not rolling it out yet.
Same behavior problem on R.P. 26200.6725, Beta 26120.6780, Dev 26220.6780 and Public Build 26200.6725.

Edition Windows 11 Pro
Version 25H2
Installed on ‎9/‎12/‎2025
OS build 26220.6780
Experience Windows Feature Experience Pack 1000.26100.262.0

View attachment 148695

View attachment 148694

Don't have this option.

Or maybe this only appear when using a MS Account instead of a Local Account?

Or maybe this feature still has some major flaws or bugs that it's delayed or something?

fg2001gf11F · Nov 5, 2025

win11freak said:
Still

Don't have this option.

Or maybe this only appear when using a MS Account instead of a Local Account?

Or maybe this feature still has some major flaws or bugs that it's delayed or something?

Works with local accounts too.
Yes, it is delayed they are still working on it.

DanTheGuy · Nov 12, 2025

I tried enabling Administrator Protection using Vivetool on my 25H2 stable build. It worked... but it caused my PC to be completely unusable. I would log onto my desktop and as my startup programs began opening I would get consent prompts for things like Logi options, then suddenly everything becomes super laggy for a bit before completely freezing up with only my mouse cursor working. It did this every time I rebooted my PC. Ultimately, switching the policy back to "Legacy Admin approval mode" fixed it. I'm not sure if the way I force-enabled the feature caused this, or if I have some programs/services that don't work well with it...

SpeedDemon · Nov 17, 2025

DanTheGuy said:
I tried enabling Administrator Protection using Vivetool on my 25H2 stable build. It worked... but it caused my PC to be completely unusable. I would log onto my desktop and as my startup programs began opening I would get consent prompts for things like Logi options, then suddenly everything becomes super laggy for a bit before completely freezing up with only my mouse cursor working. It did this every time I rebooted my PC. Ultimately, switching the policy back to "Legacy Admin approval mode" fixed it. I'm not sure if the way I force-enabled the feature caused this, or if I have some programs/services that don't work well with it...

Same issue. Microsoft now appears to have disabled Administrator Protection with Feature Flagging in 26200.7171.

dacrone · Dec 10, 2025

seems to be working now. just tested on 25H2 26200.7171 with local account

vivetool /enable /id:57048231

reboot

gpedit:
Computer Config > Windows Settings > Security Settings > Local Policies > Security Options

User Account Control: Configure Type of Admin Approval Mode = Admin Approval Mode with Administrator Protection

User Account Control: Behavior of the Elevation Prompt for Administrators Running with Administrator Protection = Prompt for Credentials

what i'm curious about is.... how does this differ from this setup?:

User Account Control: Behavior of the Elevation Prompt for Administrators Running with Administrator Protection = Prompt for Credentials on secure desktop
User Account Control: Behavior of the Elevation Prompt for standard users = Prompt for Credentials on secure desktop

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\
DWORD: ConsentPromptBehaviorAdmin = 1

(just fyi: 0 = no prompt; 1 = password on secure desktop; 2 = prompt on secure desktop; 3 = password; 4 = prompt; 5 = prompt for consent for non-windows binaries)

*also - if you want further admin lockdown to go with this:

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\CredUI\
DWORD: EnumerateAdministrators = 0

pseymour · Dec 10, 2025

dacrone said:
what i'm curious about is.... how does this differ from this setup?:

Profile separation. The admin account is created on the fly, and it goes away when the admin work is done.

Solved Still no Administrator protection on 25h2?

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer