To enable Administrator protection on a Windows 11 PC, open Windows Security → Account protection, switch on Administrator protection, and restart when prompted. For managed devices, IT can configure the related Admin Approval Mode and elevation-prompt policies through Group Policy, Local Security Policy, or Intune—provided the device build and management surface support them.
What Administrator protection does
Administrator protection keeps routine activity in a deprivileged state and provides just-in-time administrative rights when needed, with explicit user approval. Microsoft describes it as a Windows 11 platform feature that integrates authorization with Windows Hello. It is off by default.
As an Amazon Associate I earn from qualifying purchases.
It is available on Windows 11 Home, Pro, Enterprise, and Education with KB5120998, according to Microsoft’s Administrator protection documentation. Microsoft excludes Windows 365 Cloud PCs and Azure Virtual Desktop session hosts.
Turn it on in Windows Security
- Select Start, search for Windows Security, and open the app.
- Select Account protection.
- Find Administrator protection and turn on the toggle.
- Restart the PC when prompted. A reboot is required for the change to take effect.
If the setting is missing, check that Windows is updated and that the device is an eligible Windows 11 edition. Microsoft describes gradual rollout and some configuration options as preview, so a feature or control may not yet appear on every supported device.
#1 Best Overall
- Connectivity: Includes WiFi, Bluetooth, and LAN for wireless and wired connections
- Memory: Features 16GB DDR4 RAM for smooth multitasking and performance
- Storage: Combines 500GB SSD and 1TB HDD for ample storage space
- Graphics: Integrated Intel UHD Graphics 630 for crisp visuals and video playback
- Design: Sleek desktop tower with black color and slim profile for modern look
Choose a deployment method for managed PCs
| Method | Best suited to | Where to configure it |
|---|---|---|
| Windows Security | One device | Windows Security → Account protection → Administrator protection |
| Group Policy or Local Security Policy | Devices managed with Windows security policy | Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options |
| Intune | Centrally managed users or devices | Settings Catalog under Local Policies Security Options, or the LocalPoliciesSecurityOptions CSP |
Configure it with Group Policy or Local Security Policy
- Open the policy editor and go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
- Set User Account Control: Configure type of Admin Approval Mode to Admin Approval Mode with Administrator protection.
- Set User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection to the behavior your organization requires.
- Restart the device to apply the configuration.
Policy availability can vary with the Windows build and rollout stage. Verify that both policy settings are available on the target device before planning deployment.
Configure it with Intune
Microsoft documents the settings in the Intune Settings Catalog under Local Policies Security Options, and also supports custom policy through the LocalPoliciesSecurityOptions Configuration Service Provider (CSP). Configure UserAccountControl_TypeOfAdminApprovalMode to enable the mode and UserAccountControl_BehaviorOfTheElevationPromptForAdministratorProtection to set the prompt behavior, then assign the policy to the group containing the target users or devices.
Rank #2
- [INTEL POWERED CONTENT] - Built with a 8th Generation Hexa-Core Intel i5 and 32GB of DDR4 RAM; Modern, Windows 11 ready, with 4K support, Executive multitasking, media streaming and smooth, multi-tab web browsing; Perfect as an all-purpose multimedia computer; built for content creators; Plenty of RAM and Mass storage for photo and video editing powered by Intel HD 630
- [LATEST WIRELESS TECH] - This Dell Desktop Computer easily connects to the internet through the Built In WiFi / Bluetooth
- [SOLID STATE STORAGE] - This Dell Computer setup comes with an ultra-fast 1TB Solid State Drive (SSD); Setup as the primary boot device; Boot and load programs with lightning speed ; Additional expansion available
- [BUY & OWN WITH CONFIDENCE] - From the world's largest Microsoft Authorized Refurbisher; Quality Guarantee and Free Tech Support; Award-winning Customer Service; | Support Sustainable Business
- [MODERN HI-SPEED PORTS] - USB 3.0 (x4) | USB 2.0 (x4) | DisplayPort (x1) | HDMI Port (x1) | Audio Combo Jack (x1) | Audio Out (x1) | RJ-45 Ethernet (x1) | Internal SATA (x3)
The LocalPoliciesSecurityOptions CSP reference lists value 2 for Admin Approval Mode with Administrator protection and identifies applicability for the named setting as Windows Insider Preview build 11.0.26100.9278 for the listed editions. Treat that build-specific listing as a qualification, not evidence that the same control is available through every management surface or on every supported device. Check the installed build and the settings exposed in your tenant before assigning a policy.
Check compatibility before rollout
Microsoft advises against enabling Administrator protection on Windows 365 Cloud PCs and Azure Virtual Desktop session hosts. Its troubleshooting guidance also flags several scenarios that may need extra work:
Rank #3
- Model: Dell OptiPlex 7050 Small Form Factor (SFF)
- Processor: Intel Core i7-7700 3.60 GHz
- Memory: 32GB DDR4 Ram
- Storage: 1TB Solid State Drive (SSD) Fast Boot + Storage
- Operating System: Windows 11 Pro (64-bit)
- Devices that require Hyper-V.
- Applications that access shared files across user profiles.
- Development tools such as WSL or Visual Studio, which may need separate installation and configuration in the elevated profile.
Test the workflows that rely on these features or tools before enabling the setting broadly. Microsoft’s compatibility and troubleshooting guidance describes these caveats.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Monitor elevation outcomes
For troubleshooting or operational monitoring, Microsoft documents ETW event 15031 (Elevation Approved) and event 15032 (Elevation Denied/Fail) under the Microsoft-Windows-LUA provider. These events record elevation outcomes. Microsoft describes collecting traces with Logman or Windows Performance Recorder and inspecting the resulting ETL output in its Administrator protection documentation.
Why the setting may not be available
- Windows is not updated: Microsoft identifies KB5120998 as the availability update; check the device’s update state.
- The device is excluded: Windows 365 Cloud PCs and Azure Virtual Desktop session hosts are not supported for this feature.
- Rollout or policy surface differs: Microsoft describes gradual rollout and preview configuration options, while the CSP reference identifies a specific Insider Preview build for the named policy. Confirm the local toggle or management setting exists for the actual build in use.
For background on how Windows User Account Control works, see Microsoft’s User Account Control documentation.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
