If your organization uses Windows security baselines, Administrator protection becomes enabled by default with the October 2026 Windows security update. The security baselines for Windows 11 that enable Administrator protection by default apply to versions 26H2, 25H2, and 24H2.
Message ID: MC1506291
Published: Oct 13, 2026
Service: Windows
Tag: Admin impact
Use Microsoft Intune or Group Policy to manage Administrator protection enablement as part of the security baseline. The following policies are part of the security baseline:
- User Account Control: Configure type of Admin Approval Mode
- User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection
Rollout schedule
- Administrator protection is generally available (disabled by default).
- Starting with the October 2026 Windows security update, it’s enabled by default within the Windows 11 security baselines.
Impact on your organization
This change only affects IT admin roles in commercial organizations that use Administrator protection and Windows security baselines on supported devices. Administrator protection becomes enabled by default, helping protect organizations from unauthorized elevated privileges. If the new default doesn’t align with your organizational strategy, enable or disable Administrator protection via policy.
Action required/recommendations
Review and test your security baseline configuration and adjust it as appropriate for your environment. Use Microsoft Intune or Group Policy to manage Administrator protection enablement as part of the security baseline. Learn more in Administrator protection.
Compliance considerations:
No compliance considerations are identified. Review as appropriate for your organization.