Administrator Protection in Windows 11 25H2 is a security feature intended to replace UAC by providing a more robust and securable system for local users to gain administrator privileges only when necessary. The research detailed nine distinct vulnerabilities that could bypass this protection to silently escalate privileges. These vulnerabilities were responsibly disclosed to Microsoft and have been fixed either in optional update KB5067036 or later security bulletins. The feature was temporarily disabled in December 2025 due to an unrelated compatibility issue. The feature addresses fundamental design flaws in UAC, such as shared user profiles and token impersonation weaknesses, and aims to prevent silent elevation of privileges that malware has exploited for years. The research and fixes improve the security boundary for administrator privilege elevation on Windows 11.

If exploited, the vulnerabilities allowed a local user to silently gain full administrator privileges, bypassing the intended security boundary of Administrator Protection. This could enable unauthorized system modifications and elevate malware capabilities. However, all identified vulnerabilities have been fixed by Microsoft prior to or shortly after the feature's official release. The temporary disabling of Administrator Protection is unrelated to these vulnerabilities and does not affect the security fixes. There are no known exploits in the wild for these issues.

All vulnerabilities described have been fixed by Microsoft in optional update KB5067036 and subsequent security bulletins. Users should ensure their Windows 11 systems are fully updated with the latest patches. The Administrator Protection feature is currently disabled by Microsoft due to an unrelated compatibility issue; monitor official Microsoft communications for re-enablement updates. No additional action is required beyond applying official updates.