New User Account Control: Configure type of Admin Approval Mode setting

[agpt8]

Recently I came across a new setting under Local Policies in security settings in GPO called User Account Control: Configure type of Admin Approval Mode. The options included Legacy Admin approval mode (default) and Admin Approval Mode with Administrator Protection. (found in Computer config > Windows Settings > Security settings > Local Policies > Security options > User Account Control: Configure type of Admin Approval Mode)

The Explain tab doesn't really give many details on either option and the general info given is too vague. The link at the bottom leads to nowhere and I couldn't find any documentation regarding this as well.

Any idea what this might be? Is this related to admin-less windows David Weston mentioned in his black-hat talk?
This screenshot is taken on the latest Win 11 RP build 26100.1876.

[HotCakeX]

Hi,
i'm not sure at the moment, I assume it's related but I don't remember the behavior of it when i first tried it. I've been busy with the WDACConfig app development and waiting for 24H2 to be finalized because it's in release preview and dev channel at the same time, still not sure what the final build will look like.

If it turns out to be something useful (which it looks like it) i'll add it to the UAC category if the MSFT security baselines for 24H2 don't include it.

[HotCakeX]

This was just dropped and mentions the policy you asked about
https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-version-24h2-security-baseline/ba-p/4252801

I'll release new module version asap to use the 24H2 baselines on systems that run it.

[agpt8]

Nice! Thanks for the update! Though I would like to see options to override certain settings like enabling sudo (which this baseline disables), enabling Windows Protected Print, if not already enabled (set to disabled in this version but recommends enabling)

On a sidenote, the post does not really go into much details on the User Account Control settings. If you come across any more documentation than what is already posted there, please update this discussion.

[HotCakeX]

I think they should be added to the security baseline overrides. Maybe a new section in the GUI can be added to control each override individually.

And yes i'll add all the required docs to the discussion and readme whenever i find them

[agpt8]

It looks like this is definitely related to admin less user
This is from the latest canary release notes:

[HotCakeX]

Exciting, thank you!

https://blogs.windows.com/windows-insider/2024/10/02/announcing-windows-11-insider-preview-build-27718-canary-channel/