Configure Windows 11's Administrator Protection feature to replace UAC prompts with Windows Hello authentication for enhanced security. Learn three methods: Windows Security UI, Group Policy, and Registry editing.
Evan MaelAdministrator Protection is a significant security enhancement in Windows 11 that replaces traditional User Account Control (UAC) prompts with Windows Hello authentication for administrative tasks. Instead of clicking "Yes" on a UAC dialog, you'll need to authenticate using your PIN, fingerprint, or face recognition when performing elevated operations.
This feature addresses a fundamental weakness in traditional UAC: users often click "Yes" without thinking, creating a security risk. Administrator Protection forces deliberate authentication using biometric or PIN-based Windows Hello, making it much harder for malicious software to gain administrative privileges without user knowledge. The system uses just-in-time privileges with isolated tokens, providing better protection against privilege escalation attacks.
Administrator Protection is available starting with Windows 11 build 26120.4733 (24H2 Beta channel) and build 26200.5702 (25H2 Dev channel). The feature works on Pro, Enterprise, and Education editions through Group Policy, while Home edition users can access it through the Windows Security interface in later builds. Note that Microsoft temporarily disabled this feature in December 2025 due to application compatibility issues, though it remains configurable through policy settings.
This tutorial will walk you through three methods to enable Administrator Protection: the user-friendly Windows Security interface, Local Security Policy for enterprise environments, and Registry editing for advanced users. You'll also learn how to test the feature, configure advanced settings, and troubleshoot common issues.
Before configuring Administrator Protection, confirm your system meets the requirements. This feature requires specific Windows 11 builds and editions.
Open Command Prompt as administrator and run:
winverCheck that your build number is 26120 or higher for 24H2, or 26200+ for 25H2. Also verify your Windows edition:
dism /online /get-currenteditionAdministrator Protection works on Pro, Enterprise, and Education editions. Home edition users can use the Windows Security method if available.
Verification: The winver command should show build 26120.4733 or higher, and your edition should be Pro, Enterprise, or Education for full functionality.
Administrator Protection requires Windows Hello for authentication. Set up at least one Windows Hello method before enabling the feature.
Open Settings by pressing Win + I, then navigate to Accounts > Sign-in options. Configure one of these methods:
Test your Windows Hello method by locking your screen (Win + L) and signing back in using your configured method.
Verification: Lock and unlock your PC using Windows Hello. The authentication should work smoothly before proceeding.
The easiest method is through the Windows Security interface, available on all Windows 11 editions with recent updates.
Open Windows Security by searching for it in the Start menu or pressing Win + I and navigating to Privacy & security > Windows Security.
In Windows Security, click on Account protection in the left sidebar. Look for the Administrator protection settings section.
Click on Administrator protection settings to expand the options. Toggle the Administrator protection switch to On.
You'll see a confirmation dialog explaining that administrative tasks will now require Windows Hello authentication. Click Yes to confirm.
Verification: The toggle should show "On" and display "Administrator protection is turned on. Administrative tasks will require Windows Hello authentication."
For Pro and Enterprise editions, you can configure Administrator Protection through Local Security Policy for more granular control.
Press Win + R, type secpol.msc, and press Enter to open Local Security Policy.
Navigate to Local Policies > Security Options in the left panel. Scroll down to find the UAC-related policies.
Double-click on User Account Control: Configure type of Admin Approval Mode. In the dropdown menu, select Admin Approval Mode with Administrator protection and click OK.
Optionally, configure the elevation prompt behavior by double-clicking User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection. Choose your preferred option (recommended: "Prompt for credentials").
Policy Options:
- Prompt for credentials (Recommended)
- Prompt for consent
- Elevate without prompting (Not recommended)Verification: The policy should show "Admin Approval Mode with Administrator protection" as the selected option.
For advanced users or when other methods aren't available, you can enable Administrator Protection through the Windows Registry.
Press Win + R, type regedit, and press Enter to open Registry Editor.
Navigate to the following registry path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemLook for the TypeOfAdminApprovalMode DWORD value. If it doesn't exist, right-click in the right panel, select New > DWORD (32-bit) Value, and name it TypeOfAdminApprovalMode.
Double-click TypeOfAdminApprovalMode and set its value to 2. Ensure "Decimal" is selected as the base.
Registry Values:
0 = Disabled
1 = Legacy Admin Approval Mode (Default UAC)
2 = Admin Approval Mode with Administrator protectionVerification: The TypeOfAdminApprovalMode value should show "2" in the Data column.
Administrator Protection changes require a system restart to take effect. Save any open work before proceeding.
Restart your computer using one of these methods:
Alt + F4 on desktop and select "Restart"shutdown /r /t 0After restart, Windows will apply the new Administrator Protection settings. The first administrative task you perform will demonstrate the new authentication method.
Verification: After restart, attempt an administrative task like opening Command Prompt as administrator. You should see a Windows Hello authentication prompt instead of the traditional UAC dialog.
Verify that Administrator Protection is working correctly by performing administrative tasks that would normally trigger UAC prompts.
Try these test scenarios:
Instead of the traditional UAC dialog, you should see a Windows Security prompt asking for Windows Hello authentication (PIN, fingerprint, or face recognition).
The prompt will show:
Windows Security
Administrator Protection
Use Windows Hello to verify it's you
[Windows Hello authentication method]Verification: Administrative tasks should prompt for Windows Hello authentication instead of showing traditional UAC dialogs.
Fine-tune Administrator Protection behavior through additional Group Policy settings for enhanced security and usability.
Open Local Security Policy (secpol.msc) and navigate to Local Policies > Security Options. Configure these additional UAC policies:
User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection:
User Account Control: Detect application installations and prompt for elevation: Keep enabled to catch installer elevation attempts.
For enterprise environments, you can also configure:
Computer Configuration > Administrative Templates > Windows Components > Windows Hello for BusinessSet policies for PIN complexity, biometric requirements, and fallback authentication methods.
Verification: Test different administrative scenarios to ensure the configured prompt behavior works as expected.
If you need to disable Administrator Protection due to compatibility issues or other requirements, you can reverse the configuration using any of the methods used to enable it.
Via Windows Security: Open Windows Security > Account protection > Administrator protection settings, and toggle Administrator protection to Off.
Via Local Security Policy: Open secpol.msc, navigate to Local Policies > Security Options, and change User Account Control: Configure type of Admin Approval Mode back to Legacy Admin Approval Mode (Default).
Via Registry: Open regedit, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and change TypeOfAdminApprovalMode value from 2 back to 1.
After making changes, restart your computer for the changes to take effect.
Verification: After restart and disabling, administrative tasks should return to showing traditional UAC prompts instead of Windows Hello authentication.
Keep track of Administrator Protection performance and resolve common issues that may arise.
Monitor authentication events in Event Viewer:
eventvwr.mscNavigate to Windows Logs > Security and look for Event IDs related to elevation attempts:
Common troubleshooting steps:
Create a PowerShell script to check Administrator Protection status:
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "TypeOfAdminApprovalMode" | Select-Object TypeOfAdminApprovalModeVerification: Event Viewer should show successful authentication events, and the PowerShell command should return "2" when Administrator Protection is enabled.
Microsoft MCSA-certified Cloud Architect | Fortinet-focused. I modernize cloud, hybrid & on-prem infrastructure for reliability, security, performance and cost control - sharing field-tested ops & troubleshooting.
Deepen your knowledge with related resources
Share your thoughts and insights
Sign in to join the discussion