Detections
Analytics

User Account Control: Admin Approval Mode for the Built-in Administrator account

Information

User Account Control: Admin Approval Mode for the Built-in Administrator account

This security setting determines the behavior of Admin Approval mode for the Built-in Administrator account.

The options are:

 - Enabled: The Built-in Administrator will logon in Admin Approval Mode. By default any operation that requires elevation of privilege will prompt the Consent Admin to choose either Permit or Deny.

 - Disabled: The Built-in Administrator will logon in XP compatible mode and run all applications by default with full administrative privilege.

Default: Disabled

Solution

Policy Path: Security Options
Policy Setting Name: User Account Control: Admin Approval Mode for the Built-in Administrator account

See Also

https://techcommunity.microsoft.com/blog/microsoft-security-baselines/windows-11-version-25h2-security-baseline/4456231

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(5)

Plugin: Windows

Control ID: f3adf3edc1c124f20c9c8fc1043bc1f790e0d0c348bcfe9de10f819119f50286