Bypassing Windows Administrator Protection

Microsoft's Administrator Protection feature, intended to replace User Account Control (UAC) with a more secure system for granting administrator privileges in Windows 11, has been found to be bypassable. The feature, introduced in Windows 11 version 25H2, aims to allow local users to access administrative rights only when necessary, creating a more robust security boundary. However, security researcher James Forshaw detailed a method to silently gain full administrator privileges by exploiting vulnerabilities discovered during the feature's insider preview phase.

Administrator Protection was designed to address the security shortcomings of UAC, which was introduced in Windows Vista. UAC initially aimed to grant temporary administrator privileges while most processes ran with limited rights. However, its design, where both limited and administrator users shared profile resources like directories and registry hives, meant it did not represent a hard security boundary. This design allowed for potential impersonation of administrator processes by limited users.

Further weakening UAC, Windows 7 introduced an "auto-elevation" feature, allowing certain Microsoft binaries to be elevated without user interaction. This created opportunities for attackers to repurpose these binaries to gain administrator privileges silently. While UAC could be configured to always show a prompt, the default auto-elevation setting was often left unchanged. The existence of numerous UAC bypass techniques, such as those documented in the UACMe tool, highlights the ongoing challenge of maintaining a secure elevation mechanism. Malware has frequently exploited these known bypasses to gain administrator access, a problem Administrator Protection was intended to solve.

Administrator Protection builds upon a more secure UAC mechanism known as "over-the-shoulder" elevation. This method, used when a user is not part of the administrators group, requires the input of a local administrator's credentials, typically entered by a system administrator. It prevents the sharing of profile data and prohibits limited users from impersonating administrator accounts. Crucially, it does not support auto-elevation of Microsoft binaries, ensuring all elevation requests require explicit user confirmation. However, this method has practical limitations, particularly concerning the secure sharing of administrator credentials.

Administrator Protection enhances the over-the-shoulder approach by employing a separate, automatically configured "shadow administrator account." This eliminates the need for users to know or input credentials, as UAC can be configured to accept the limited user's credentials, including biometric authentication. It also simplifies deployment by not requiring a separate local administrator account, as the user only needs to be a member of the administrators group. While Microsoft refers to Administrator Protection as a distinct feature, it functions as a third UAC mechanism, leveraging existing infrastructure with modifications. It replaces the "admin-approval" mode, meaning the legacy mode cannot be used concurrently. Currently, there is no graphical interface to enable Administrator Protection; it must be configured through local security policy.

Forshaw's research into Administrator Protection was initiated after Microsoft invited him to identify issues during the insider preview stage, likely due to his history of finding complex UAC bypasses. While initially agreeing to provide feedback on a design document without conducting a full penetration test, he was assured that any discovered vulnerabilities would be addressed through security bulletins or prior to the feature's final release. He noted that bypassing the intended security boundary would likely involve compromising the shadow administrator's profile, hijacking an existing shadow administrator process, or gaining administrator privileges without a prompt.

Forshaw discovered nine separate vulnerabilities that allowed for the bypass of Administrator Protection, enabling silent acquisition of full administrator privileges. All the issues he reported to Microsoft have since been fixed. These fixes were implemented either before the feature's official release, through an optional update (KB5067036), or in subsequent security bulletins. It is important to note that as of December 1, 2025, Microsoft has disabled the Administrator Protection feature to address an application compatibility issue. This disabling is not believed to be related to the vulnerabilities Forshaw identified.