Microsoft has reintroduced the Administrator Protection feature in Windows 11, which is expected to launch with the 26H2 version. The feature was previously tested in Insider Preview builds but was removed in 25H2 following feedback from Google Project Zero regarding security vulnerabilities.
Administrator Protection allows non-privileged users to obtain temporary administrative rights verified via Windows Hello. Upon authentication, the system creates an isolated, profile-separated account to generate a temporary token for the requested process, which is destroyed immediately after the task concludes.
The feature is currently disabled by default and requires manual configuration via OMA-URI, Intune, CSP, or Group Policy. Microsoft emphasizes that this is not a formal security boundary but a tool to strengthen infrastructure against privilege escalation attacks.
The update also introduces significant UI changes, including the ability to position the taskbar on the top, bottom, left, or right sides of the screen. Users can now adjust taskbar and Start menu sizes, with the 'Recommended' section in the Start menu renamed to 'Recent'.
New technical capabilities include Microsoft Execution Container (MXC) for process isolation, support for post-quantum encryption algorithm ML-KEM in TLS, and the removal of the WMIC utility starting in August 2026 for versions 24H2 and 25H2.
