Podcast Summary: Hands-On Windows 157 – Administrator Protection

Podcast: All TWiT.tv Shows (Audio)
Host: Paul Thurrott
Episode: Hands-On Windows 157: Administrator Protection
Date: September 11, 2025

Episode Overview

This episode delves into a major new security feature rolling out in Windows 11 25H2 (and backported to 24H2): Administrator Protection. Longtime Windows specialist Paul Thurrott explains how this feature aims to finally address a decades-old vulnerability tied to admin account privileges, making Windows environments more secure without introducing significant usability headaches.

Key Discussion Points & Insights

The History and Evolution of Windows Account Security

• Windows Account Types Explained

  • Paul recaps how Windows user accounts evolved from local-only setups (introduced with Windows NT in 1993), to later integration with online Microsoft accounts from Windows 8 onward.
  • Differences between local, Microsoft, work, and school accounts—Microsoft is deprecating local accounts in favor of cloud-tied authentication. ([03:00])

• Online Accounts and Windows Hello

  • Windows Hello covers facial recognition, fingerprint, and PIN sign-ins, delivering strong authentication methods.
  • "On this particular computer, I have facial recognition, but not fingerprint… everyone has a pin… These three things collectively are referred to as Windows hello." – Paul Thurrott ([05:18])
  • Enhanced security is becoming the standard, especially on new Copilot+ PCs.

The Admin Privilege Problem

• All-Powerful Accounts By Default

  • "Every first user on any computer… is an administrator account, and they have elevated privileges. If your account is compromised, a hacker could… run malicious code at this escalated level." ([07:50])
  • Standard best practice was to set up a separate non-admin user for daily tasks, but almost no one does this because it’s too inconvenient.

• User Account Control (UAC) Limitations

  • UAC originally provided prompts before elevating to admin privileges, but it's widely ignored: "There's no sense of authentication there… it's just like the third brake light on a car, it's just a little extra, 'Hey, are you sure?'" ([09:00])
  • Most users simply click “Yes” without careful consideration.

Administrator Protection: The New Solution

• How It Works

  • Found in the Windows Security app under “Account Protection” as a simple toggle (on/off).
  • Once enabled and the system restarts, all admin accounts operate as if they're standard users for most tasks.
  • When a higher privilege is needed (installing software, editing the registry, changing system time), Windows throws up a secure Windows Hello–powered authentication dialog.
  • "When you run a task that needs an escalated privilege level, it will throw up… a Windows hello authentication dialog." ([11:00])

• Security Benefits

  • “From a kind of a process perspective, this works exactly like UAC, but under the covers, this is in fact way more secure than UAC… they create a temporary in-time admin level process that runs, does the thing you need to do and then disappears.” ([11:50])
  • Everyday tasks happen at lower privileges, cutting the risk of malware or hackers escalating access through user sessions.

• Real-World Usage

  • Triggered by actions such as software installs, editing the registry, changing time settings, and (potentially) accessing sensitive corporate data.
  • The prompts operate similarly to current UAC, so “day to day your life is not going to change very much, but the security of your system is going to change dramatically.” ([13:20])

• Practical Details

  • Administrator Protection is not enabled by default.
    • Users should activate it manually once they get 25H2, or join the Insider Program’s Dev/Beta channel to test now ([13:50]).
    • More frequent prompts are expected, but not an overwhelming increase compared to today.

Thurrott’s Professional and Personal Take

• Paul expresses strong personal enthusiasm, calling this “actually pretty great” and noting how it addresses a fundamental Windows weakness spanning back to NT's beginnings.
• “I've been following Windows since NT was just started and this has always been a problem… UAC was one attempt… but I think Administrator Protection is it. Now that we have Windows Hello, I think they finally cracked the nut on this.” ([14:30])
• Final advice: “I strongly, strongly recommend enabling this when you can.” ([15:10])

Notable Quotes & Memorable Moments

• On Windows Account Types:
  “The work that Microsoft did originally in Windows NT… was this sense of user accounts—that everyone would have their own account when they had signed into the PC…” – Paul Thurrott ([03:40])

• On Why No One Runs a Separate Non-Admin Account:
  “No one does this. And even the people that are well meaning… find that it’s just too annoying to do, because there are just too many times where you need the approval of someone else… No one does it. So this is the problem.” ([08:40])

• Explaining the Security Leap:
  “From a kind of a process perspective, this works exactly like UAC, but under the covers, this is in fact way more secure than UAC…” ([11:50])

• Final Recommendation:
  “I strongly, strongly recommend enabling this when you can.” ([15:10])

Key Timestamps

• 03:00–06:00 – Evolution of Windows user accounts and authentication
• 07:50–09:45 – The admin privilege problem, why separate accounts don’t work
• 10:20–12:30 – Administrator Protection: mechanics, security model, how to enable
• 12:31–14:20 – Real-world examples and the difference from UAC prompts
• 14:25–15:20 – Paul's assessment and final recommendation

Takeaways

Administrator Protection is a genuine leap forward in Windows security, finally solving a problem that’s existed for over 30 years. By wrapping admin-level actions in robust Windows Hello authentication and minimizing persistent elevated privileges, the new feature offers a practical way for everyone—including non-techies—to run a safer Windows PC. Thurrott's verdict: turn it on as soon as you can!

For more episodes and in-depth coverage, visit TWiT.tv Hands-On Windows.