Administrator protection enabled by default in Windows 11 security baselines

WindowsIntune

Who is affected

Organisations applying the Windows 11 security baseline (26H2, 25H2 or 24H2) through Intune or Group Policy. Local admins get just-in-time elevation prompts instead of a standing admin token.

What to do

1. Test the baseline on a pilot ring, especially for apps and scripts that elevate.
2. Adjust the two User Account Control baseline settings in Intune or Group Policy if you need a different behaviour.
3. Brief the helpdesk on the new elevation prompt.

Source

Manage Administrator protection within Windows 11 security baseline“If your organization uses Windows security baselines, Administrator protection becomes enabled by default with the October 2026 Windows security update.”

Checked 9 Nov 2026 Link to this deadline