Detections
Analytics

User Account Control: Admin Approval Mode for the Built-in Administrator account

Information

User Account Control: Admin Approval Mode for the Built-in Administrator account

This security setting determines the behavior of Admin Approval mode for the Built-in Administrator account.

The options are:

 Enabled: The Built-in Administrator will logon in Admin Approval Mode. By default any operation that requires elevation of privilege will prompt the Consent Admin to choose either Permit or Deny.

 Disabled: The Built-in Administrator will logon in XP compatible mode and run all applications by default with full administrative privilege.

Default: Disabled

Solution

Policy Path: Security Options
Policy Setting Name: User Account Control: Admin Approval Mode for the Built-in Administrator account

See Also

https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-baseline-for-windows-server-2025-version-2506/4426431

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(5)

Plugin: Windows

Control ID: 153cf655320e2c0e59f1823904f604e6f1433e385036d47fece426e44d3acb98