Hands-On Windows 157: Administrator Protection

Summary

Podcast Summary: Hands-On Windows 157 – Administrator Protection

Podcast: All TWiT.tv Shows (Audio)
Host: Paul Thurrott
Episode: Hands-On Windows 157: Administrator Protection
Date: September 11, 2025

---

Episode Overview

This episode delves into a major new security feature rolling out in Windows 11 25H2 (and backported to 24H2): Administrator Protection. Longtime Windows specialist Paul Thurrott explains how this feature aims to finally address a decades-old vulnerability tied to admin account privileges, making Windows environments more secure without introducing significant usability headaches.

---

Key Discussion Points & Insights

The History and Evolution of Windows Account Security

• Windows Account Types Explained

  • Paul recaps how Windows user accounts evolved from local-only setups (introduced with Windows NT in 1993), to later integration with online Microsoft accounts from Windows 8 onward.
  • Differences between local, Microsoft, work, and school accounts—Microsoft is deprecating local accounts in favor of cloud-tied authentication. ([03:00])

• Online Accounts and Windows Hello

  • Windows Hello covers facial recognition, fingerprint, and PIN sign-ins, delivering strong authentication methods.
  • "On this particular computer, I have facial recognition, but not fingerprint… everyone has a pin… These three things collectively are referred to as Windows hello." – Paul Thurrott ([05:18])
  • Enhanced security is becoming the standard, especially on new Copilot+ PCs.

The Admin Privilege Problem

• All-Powerful Accounts By Default

  • "Every first user on any computer… is an administrator account, and they have elevated privileges. If your account is compromised, a hacker could… run malicious code at this escalated level." ([07:50])
  • Standard best practice was to set up a separate non-admin user for daily tasks, but almost no one does this because it’s too inconvenient.

• User Account Control (UAC) Limitations

  • UAC originally provided prompts before elevating to admin privileges, but it's widely ignored: "There's no sense of authentication there… it's just like the third brake light on a car, it's just a little extra, 'Hey, are you sure?'" ([09:00])
  • Most users simply click “Yes” without careful consideration.

Administrator Protection: The New Solution

• How It Works

  • Found in the Windows Security app under “Account Protection” as a simple toggle (on/off).
  • Once enabled and the system restarts, all admin accounts operate as if they're standard users for most tasks.
  • When a higher privilege is needed (installing software, editing the registry, changing system time), Windows throws up a secure Windows Hello–powered authentication dialog.
  • "When you run a task that needs an escalated privilege level, it will throw up… a Windows hello authentication dialog." ([11:00])

• Security Benefits

  • “From a kind of a process perspective, this works exactly like UAC, but under the covers, this is in fact way more secure than UAC… they create a temporary in-time admin level process that runs, does the thing you need to do and then disappears.” ([11:50])
  • Everyday tasks happen at lower privileges, cutting the risk of malware or hackers escalating access through user sessions.

• Real-World Usage

  • Triggered by actions such as software installs, editing the registry, changing time settings, and (potentially) accessing sensitive corporate data.
  • The prompts operate similarly to current UAC, so “day to day your life is not going to change very much, but the security of your system is going to change dramatically.” ([13:20])

• Practical Details

  • Administrator Protection is not enabled by default.
    • Users should activate it manually once they get 25H2, or join the Insider Program’s Dev/Beta channel to test now ([13:50]).
    • More frequent prompts are expected, but not an overwhelming increase compared to today.

Thurrott’s Professional and Personal Take

• Paul expresses strong personal enthusiasm, calling this “actually pretty great” and noting how it addresses a fundamental Windows weakness spanning back to NT's beginnings.
• “I've been following Windows since NT was just started and this has always been a problem… UAC was one attempt… but I think Administrator Protection is it. Now that we have Windows Hello, I think they finally cracked the nut on this.” ([14:30])
• Final advice: “I strongly, strongly recommend enabling this when you can.” ([15:10])

---

Notable Quotes & Memorable Moments

• On Windows Account Types:
  “The work that Microsoft did originally in Windows NT… was this sense of user accounts—that everyone would have their own account when they had signed into the PC…” – Paul Thurrott ([03:40])

• On Why No One Runs a Separate Non-Admin Account:
  “No one does this. And even the people that are well meaning… find that it’s just too annoying to do, because there are just too many times where you need the approval of someone else… No one does it. So this is the problem.” ([08:40])

• Explaining the Security Leap:
  “From a kind of a process perspective, this works exactly like UAC, but under the covers, this is in fact way more secure than UAC…” ([11:50])

• Final Recommendation:
  “I strongly, strongly recommend enabling this when you can.” ([15:10])

---

Key Timestamps

• 03:00–06:00 – Evolution of Windows user accounts and authentication
• 07:50–09:45 – The admin privilege problem, why separate accounts don’t work
• 10:20–12:30 – Administrator Protection: mechanics, security model, how to enable
• 12:31–14:20 – Real-world examples and the difference from UAC prompts
• 14:25–15:20 – Paul's assessment and final recommendation

---

Takeaways

Administrator Protection is a genuine leap forward in Windows security, finally solving a problem that’s existed for over 30 years. By wrapping admin-level actions in robust Windows Hello authentication and minimizing persistent elevated privileges, the new feature offers a practical way for everyone—including non-techies—to run a safer Windows PC. Thurrott's verdict: turn it on as soon as you can!

---

For more episodes and in-depth coverage, visit TWiT.tv Hands-On Windows.

Transcript

[Paul Thurrott]

Coming up next on Hands on Windows, we're going to take a look at a new security feature in Windows 1125H2 called Administrative Protection. It's more exciting than it sounds.

[US Cellular Announcer]

Have you noticed that the way we use our phones is ironic? Phones are for connections, but we look at them more than we look at each other. That's ironic. So U.S. cellular created U.S. mode to help us reconnect. It helps us use phones a little less. Ironically, a phone company wanting people to use their phones less is ironic. Let's find US again with US mode from US Cellular. Visit uscellular.com builtforus to get started, let's.

[Travel Segment Host]

Map out this week's amazing destinations and travel tips.

[Will]

Honestly, Will, I didn't plan any trips, but I did switch to T Mobile with their new Family Freedom offer.

[Travel Segment Host]

That's not the itinerary we're following.

[Will]

Well, I'm departing from ATT and embarking on a new journey with T Mobile. They paid off my family's four phones $3200 and gave us four new phones on the house.

[Paul Thurrott]

Bon voyage.

[T-Mobile Announcer]

Introducing Family Freedom. Our lowest cost will switch our biggest family savings all on America's largest 5G network. Visit your local T Mobile location or learn more@t mobile.com familyfreedom up to $800.

[T-Mobile Terms Announcer]

Per line via virtual prepaid card typically takes 15 days. Free phones via 24 monthly bill credits with finance agreement eg Apple iPhone 16128 gigabyte 82999 eligible trade in eg iPhone 11 Pro for well qualified credits end and balance due if you pay off earlier.

[T-Mobile Announcer]

Cancel contact T mo Imagine you're a.

[Odoo Announcer]

Business owner relying on a dozen different software programs, each one disconnected. More expensive and more complicated than the last, it can be incredibly stressful right now. Picture Odoo Odoo brings all the tools your business needs into one simple CRM, accounting, inventory, manufacturing, marketing, HR and more. All seamlessly connected. Everything works together, giving you the peace of mind that your business is running smoothly from every angle. Odoo's open source applications are user friendly and designed to scale with your business, saving you time and money. Say goodbye to juggling multiple platforms and hello to efficient integrated management. Stop wasting resources on complicated systems and make the switch to odoo today. Visit odoo.com o d o o.com and discover how Odoo can simplify and streamline your business operations. Odoo Modern Management made simple.

[Travel Segment Host]

Podcasts you.

[Will]

Love from people you trust.

[Travel Segment Host]

This is twit.

[Paul Thurrott]

Hello everybody and welcome back To Hands on Windows. I'm Paul Throt and this week we are going to take a look at a new security feature coming to Windows 11, 25H2, but also to 24H2 because they back port everything these days. And this is a really good solution to a problem that we've had in Windows for I'm going to say 30 years. So I'm actually really excited about this. It doesn't sound like it's exciting, but this is actually pretty great. So if you're familiar with how accounts work in Windows 11. Good, because I don't have time to describe the whole thing, but we've talked about this a lot on the show. We've talked about this notion of signing with a Microsoft account, signing in with a work or school account, signing in with a local account, which is deprecated in the sense that Microsoft really doesn't want you to do that anymore. But all of the things that we see in accounts in Windows 11 kind of date back to 30, it's actually 30 plus years ago now. And the work that Microsoft did originally in Windows NT and, and among the many changes that NT brought was this sense of user accounts, right? That everyone would have their own account when they had signed into the PC. And these things evolved over time. There were starts and stops and you know, Windows 9X sort of supported it, but not really. But in NT based operating systems, which is what we have now. And then starting with XP, especially in 2001, this kind of became mainstream and then improved over time, right? And so from the beginning, you know, for the beginning of NT, which was 1993 all the way through going to say Windows 8, we would sign in with a local account, as you do today, say on a Mac, which is just an account you create just for that computer you're assigned or you give yourself, if you're the only user, some form of privileges, typically administrator or standard user privileges. And those that account type determines what you're able to do without getting the approval from an administrator if you are a standard user, right. And so that was the system for a long time. So Windows 8 introduced the concept of online accounts, Microsoft accounts as we call them today, and then work in school accounts. And so rather than creating an account that was only on that computer, you just sign into account you already have, that's up in the cloud, as we would call it today, Microsoft account. And that's fine. And there's some many controversies around that. But one of the nice things there is just the ability to recover your account they have protections built in for your data up in the cloud, et cetera, et cetera. So there's reasons for is, but we've also added this notion of different ways to sign in, right? And these can be very, very secure. So on this particular computer, I have facial recognition, but not fingerprint recognition, does not have a fingerprint reader. And then everyone has a pin. So anytime you sign in with an online account, whatever kind of account it is, as long as it's an online account, you have to create a pin. And these three things collectively are referred to as Windows hello. Right? So Windows hello facial recognition, fingerprint recognition or pin. And on this particular computer, which is a Copilot plus PC, it's Windows hello Enhanced security or enhanced sign in security, which is an even more secure form of Windows hello. So this is a really nice authentication system and it's the way that you authenticate yourself. And so when you sign into your computer, however, you do kind of passes through that authentication to different services. And that's the reason why if I were to go, say to the Microsoft Store, it will automatically sign me into this account, which is that account that I signed into the computer with. Now I can change that, but that's one of those niceties that it just kind of passes through.

[Travel Segment Host]

Let's map out this week's amazing destinations and travel tips.

[Will]

Honestly, Will, I didn't plan any trips, but I did switch to T Mobile with their new Family Freedom offer.

[Travel Segment Host]

That's not the itinerary we're following.

[Will]

Well, I'm departing from ATT and embarking on a new journey with T Mobile. They paid off my family's four phones up to $3200 and gave us four new phones. On the house.

[Paul Thurrott]

Bon voyage.

[T-Mobile Announcer]

Introducing Family Freedom. Our lowest cost will switch our biggest family savings all on America's largest 5G network. Visit your local T Mobile location or learn more@t mobile.com familyfreedom.

[T-Mobile Terms Announcer]

Up to $800 per line via virtual prepaid card typically takes 15 days. Free phones via 24 monthly bill credits with finance agreement eg Apple iPhone 16128 gigabyte 82999 eligible trade in eg iPhone 11 Pro for well credits end and balance due if you pay off earlier.

[T-Mobile Announcer]

Cancel contact T Mobile this episode brought.

[Travel Segment Host]

To you by Red Canary. When cybersecurity threats hit fast, you need an MDR partner that moves faster. Red Canary delivers 24.7expert MDR support, total visibility and actionable insights. Plus it helps you detect four times more threats so you can Stay ahead without burning out. Red Canary clears the noise and has your back every hour, every incident. Get the backup you deserve. Visit redcanary.com difference to learn.

[Paul Thurrott]

So tied to this notion of online accounts, or just accounts in general, I guess, in Windows is, of course, security. And one of the big problems with security in Windows is that every user, by default, every first user on any computer certainly is an administrator account, and they have elevated privileges. And that means as you do things, you're basically allowed to do anything you want to do on the computer. But if your account is compromised, that means that a hacker could also run malicious code at this escalated level. And so the advice over the years was what you should do was sign in the first time, because you have to with whatever account and it becomes an administrator account. So in my case here, it's a Microsoft account. And then in Windows 11, what you would do is go down to other users. I've actually created a second account, but you'd add an account, and so you could create or sign into a Microsoft account or whatever kind of account, and that account would be a standard user account. Right. And so I think this one is probably an admin. But let me bring this little guy up. Actually, we're seeing the feature I want to show you. You're not seeing it because it's hiding, but by default, this thing would be a standard user account. And so if you're signed in, then you would sign in as that user. Most of the tasks that are running as you use the computer are running at a lower privilege level. And so the system is more secure. But it's also annoying because you have to ask the admin on the computer, which is you. Right, but with a different sign in for approval to do certain things. No one does this. So this is the problem. No one does this. And even the people that are, well meaning that want to do this, or the companies that are well meaning that want to do this find that it's just too annoying to do because there are just too many times where you need the approval of someone else, maybe or just yourself, where you have to just provide a second sign in interrupts what you're trying to do. It takes too long. Nobody does it. So the solution to this problem is something called administrator protection. This is rolling out, like I said, in Windows 1125H2. And let me find the. I had to take screenshots of this because I've already set this up. But if you look at this shot here, this is the Windows security app, which I will Go to later, you'll see a new Administrator Protection section under Account Protection. So that's new to 25H2. And when you click on the Administrative Protection settings, you'll see that there's one setting and it is off. And if you enable it, you have to restart. And then once you restart, the system is running with Administrative Protection on, there's nothing else to do. So if I go in there right now and find Windows Security, this is in dark mode, so it's a little easier on the eyes. If it ever loads and go to Account Protection, you can see this here again, same thing. There's one setting. This is it. It's on or it's off. So it is on. Now, I can't show you the prompt, but what I can tell you is that you're pro. You use Windows. So you've seen a user account control prompt. You know what that is, but you may not actually know what it is. If you think about you've seen it, but you may not really understand it. There's no sense of authentication there, right? You're already signed in as an admin, usually most people are. So when you see that, it's sort of like the third brake light on a car, it's just like a little extra, like, hey, just think about this for a second. Are you sure you want to do this? And you say yes, and you move on. And most people don't think about it that much. So with Administrative Protection on, most of the tasks that you're running are actually just running always at a lower escalation level, a lower level of privilege. When you run a task that needs an escalated privilege level, it will throw up not a user account control, but rather a Windows hello authentication dialog. So I had to take a screenshot. This is a Microsoft screenshot. So I have to show you this because when it comes up on the screen, my screen recording software will not record it because you know it's actually a secure process, right? And so in this case, what it's doing is a Windows hello facial recognition. You can see here there are options for fingerprint and pin. And you'll. What you see there will depend on your system. I have. My laptop is to my left here, so I have to turn to it. So when this thing comes on, I have to actually look at it. It looks at me and says, okay, you're you, and then you're allowing the change. So from a kind of a process perspective, this works exactly like uac, but under the covers. This is in fact way more secure than uac because normally you're just doing everything at a standard user level of protection even though you have an admin account. It's just that when this happens that they create a. It's basically a temporary in time admin level processes that runs, does the thing you need to do and then disappears. So it's just a slice in time thing and normally you're not running at that escalated level. So what are the types of things that would set this thing off? Installing software. So if I go and try to. I just like tried to do this earlier like this focusrite driver. When I click on this again you're not going to really see the system. I have to look right at the camera here. It sees that it's me, it says it's okay. Welcome back, Paul. Allow changes. Your screen just went blank, I'm sure. And then the thing runs, but I'm going to close it down because I don't need that. It will if you try to edit the registry, right? There are certain settings if you try to change the time, which I know sounds like a weird thing to have protected, but you know, there are reasons for that and you just have to say yeah, no I really want to do this. And so it runs elevated, goes away and then you're done. So there's a third category and this one I haven't been able to find an example of when you are accessing sensitive data, whatever that means. So I suspect that that one might be more oriented toward, toward like a work or school account where you maybe you're going into like a company owned data repository, whatever, but I haven't seen one of those for individuals yet. So installing software, certainly setting certain features, you know, changing the time or editing the registry, that kind of thing. We'll set this off. So I guess the important thing here is just that a, this thing is not on by default. So Once you get 25H2 you should enable it or if you want to test it now, join the insider program dev or beta channel will get this for you. It's in the Windows security app. Like I said, turn it on, reboot. As far as day to day, you'll probably see more prompts than usual, but it's not going to be off the charts. It's a slightly different experience because it's Windows hello. So it's not uac, but the interruption level is just about the same. And so day to day your life is not going to change very much, but the security of your system is going to change dramatically. So whether or not you think that's exciting, I guess it's a matter of opinion, but I think this is exciting. This is. Like I said, I've been following Windows since NT was just started and this has always been a problem. It's always been a problem and it's always been a problem. And they, you know, done little UIC was one attempt and okay, it was a good step in the right direction. But I think administrative protection is the. Is it now that we have Windows. Hello. I think this they finally cracked the nut on this. So this is something everyone's going to want to turn on. I strongly, strongly recommend enabling this when you can. So I hope you found this to be useful. We record new episodes of Hands on Windows or we release new episodes of Hands on Windows every Thursday. You can find out more at TWiT TV. HRW. Thank you for watching. Thank you especially to our Club TWIT members. We love you. If you're not a member, please Twit TV Club Twit. Give it a look. Think about supporting everybody who's working hard to bring you this content. Really appreciate it and I will see you next week. It.