How to Enable Administrator Protection for Admin Approval Mode in Windows 11

Before configuring Administrator Protection, confirm your system meets the requirements. This feature requires specific Windows 11 builds and editions.

Open Command Prompt as administrator and run:

winver

Check that your build number is 26120 or higher for 24H2, or 26200+ for 25H2. Also verify your Windows edition:

dism /online /get-currentedition

Administrator Protection works on Pro, Enterprise, and Education editions. Home edition users can use the Windows Security method if available.

Administrator Protection requires Windows Hello for authentication. Set up at least one Windows Hello method before enabling the feature.

Open Settings by pressing Win + I, then navigate to Accounts > Sign-in options. Configure one of these methods:

• Windows Hello PIN: Click "PIN (Windows Hello)" and set up a numeric PIN
• Fingerprint: Click "Fingerprint recognition (Windows Hello)" if you have a compatible reader
• Face recognition: Click "Facial recognition (Windows Hello)" if you have a compatible camera

Test your Windows Hello method by locking your screen (Win + L) and signing back in using your configured method.

The easiest method is through the Windows Security interface, available on all Windows 11 editions with recent updates.

Open Windows Security by searching for it in the Start menu or pressing Win + I and navigating to Privacy & security > Windows Security.

In Windows Security, click on Account protection in the left sidebar. Look for the Administrator protection settings section.

Click on Administrator protection settings to expand the options. Toggle the Administrator protection switch to On.

You'll see a confirmation dialog explaining that administrative tasks will now require Windows Hello authentication. Click Yes to confirm.

For Pro and Enterprise editions, you can configure Administrator Protection through Local Security Policy for more granular control.

Press Win + R, type secpol.msc, and press Enter to open Local Security Policy.

Navigate to Local Policies > Security Options in the left panel. Scroll down to find the UAC-related policies.

Double-click on User Account Control: Configure type of Admin Approval Mode. In the dropdown menu, select Admin Approval Mode with Administrator protection and click OK.

Optionally, configure the elevation prompt behavior by double-clicking User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection. Choose your preferred option (recommended: "Prompt for credentials").

Policy Options:
- Prompt for credentials (Recommended)
- Prompt for consent
- Elevate without prompting (Not recommended)

For advanced users or when other methods aren't available, you can enable Administrator Protection through the Windows Registry.

Press Win + R, type regedit, and press Enter to open Registry Editor.

Navigate to the following registry path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Look for the TypeOfAdminApprovalMode DWORD value. If it doesn't exist, right-click in the right panel, select New > DWORD (32-bit) Value, and name it TypeOfAdminApprovalMode.

Double-click TypeOfAdminApprovalMode and set its value to 2. Ensure "Decimal" is selected as the base.

Registry Values:
0 = Disabled
1 = Legacy Admin Approval Mode (Default UAC)
2 = Admin Approval Mode with Administrator protection

Administrator Protection changes require a system restart to take effect. Save any open work before proceeding.

Restart your computer using one of these methods:

• Click Start menu > Power > Restart
• Press Alt + F4 on desktop and select "Restart"
• Use Command Prompt: shutdown /r /t 0

After restart, Windows will apply the new Administrator Protection settings. The first administrative task you perform will demonstrate the new authentication method.

Verify that Administrator Protection is working correctly by performing administrative tasks that would normally trigger UAC prompts.

Try these test scenarios:

1. Open Command Prompt as Administrator: Right-click Start button > "Terminal (Admin)" or search "cmd" and select "Run as administrator"
2. Modify system files: Try editing a file in C:\Windows\System32 (create a test file first)
3. Install software: Download and run any installer that requires elevation

Instead of the traditional UAC dialog, you should see a Windows Security prompt asking for Windows Hello authentication (PIN, fingerprint, or face recognition).

The prompt will show:

Windows Security
Administrator Protection
Use Windows Hello to verify it's you
[Windows Hello authentication method]

Fine-tune Administrator Protection behavior through additional Group Policy settings for enhanced security and usability.

Open Local Security Policy (secpol.msc) and navigate to Local Policies > Security Options. Configure these additional UAC policies:

User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection:

• Prompt for credentials: Always requires Windows Hello (most secure)
• Prompt for consent: Shows consent dialog with Windows Hello option
• Elevate without prompting: Bypasses prompts (not recommended)

User Account Control: Detect application installations and prompt for elevation: Keep enabled to catch installer elevation attempts.

For enterprise environments, you can also configure:

Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business

Set policies for PIN complexity, biometric requirements, and fallback authentication methods.

If you need to disable Administrator Protection due to compatibility issues or other requirements, you can reverse the configuration using any of the methods used to enable it.

Via Windows Security: Open Windows Security > Account protection > Administrator protection settings, and toggle Administrator protection to Off.

Via Local Security Policy: Open secpol.msc, navigate to Local Policies > Security Options, and change User Account Control: Configure type of Admin Approval Mode back to Legacy Admin Approval Mode (Default).

Via Registry: Open regedit, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and change TypeOfAdminApprovalMode value from 2 back to 1.

After making changes, restart your computer for the changes to take effect.

Keep track of Administrator Protection performance and resolve common issues that may arise.

Monitor authentication events in Event Viewer:

eventvwr.msc

Navigate to Windows Logs > Security and look for Event IDs related to elevation attempts:

• Event ID 4648: Logon with explicit credentials (successful elevations)
• Event ID 4625: Failed logon attempts (failed authentications)
• Event ID 5156: Windows Filtering Platform connection events

Common troubleshooting steps:

1. Windows Hello not working: Reconfigure Windows Hello in Settings > Accounts > Sign-in options
2. Applications failing to elevate: Check application compatibility or temporarily disable Administrator Protection
3. Performance issues: Monitor system resources during authentication prompts

Create a PowerShell script to check Administrator Protection status:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "TypeOfAdminApprovalMode" | Select-Object TypeOfAdminApprovalMode