MC1506291 Low
Manage Administrator protection within Windows 11 security baseline
Summary AI-generated
Administrator protection will be enabled by default in Windows 11 security baselines with the October 2026 security update for versions 26H2, 25H2, and 24H2.
Suggested actions AI-generated
- Review your security baseline configuration
- Test security baseline adjustments
- Manage Administrator protection in Intune or Group Policy
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1418203 Windows settings backup policy is becoming a new default
- MC1483538 Windows settings backup is now enabled by default for eligible devices
- MC1193689 Microsoft baseline security mode for Office, SharePoint, Exchange, Teams, and Entra
- MC1465669 Expanding memory integrity protection across Windows devices
- MC1438491 Admin control for single sign-on prompts in Windows
- MC1324285 Microsoft Defender XDR: Password protection account action buttons
Original post from Microsoft
What and why:
If your organization uses Windows security baselines, Administrator protection becomes enabled by default with the October 2026 Windows security update. The security baselines for Windows 11 that enable Administrator protection by default apply to versions 26H2, 25H2, and 24H2.
Use Microsoft Intune or Group Policy to manage Administrator protection enablement as part of the security baseline. The following policies are part of the security baseline:
- User Account Control: Configure type of Admin Approval Mode
- User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection
Rollout schedule:
- Administrator protection is generally available (disabled by default).
- Starting with the October 2026 Windows security update, it’s enabled by default within the Windows 11 security baselines.
Impact on your organization:
This change only affects IT admin roles in commercial organizations that use Administrator protection and Windows security baselines on supported devices. Administrator protection becomes enabled by default, helping protect organizations from unauthorized elevated privileges. If the new default doesn’t align with your organizational strategy, enable or disable Administrator protection via policy.
Action required/recommendations:
Review and test your security baseline configuration and adjust it as appropriate for your environment. Use Microsoft Intune or Group Policy to manage Administrator protection enablement as part of the security baseline. Learn more in Administrator protection.
Compliance considerations:
No compliance considerations are identified. Review as appropriate for your organization.