Winsage
October 10, 2024
Microsoft has introduced a security feature called Administrator Protection in its latest Windows preview version, aimed at enhancing local administrator privileges and reducing the risk of privilege escalation exploits. This feature changes the elevation of privileges from an unrestricted process to a controlled "just-in-time" event, utilizing an isolated, ephemeral shadow administrator account that disappears after use. This approach replaces the previous split-token model governed by User Account Control (UAC) and complicates attempts by cybercriminals to misuse elevated privileges. The feature is designed to hinder attackers who exploit common applications and administrative privileges for lateral movement within networks. It is disabled by default and requires activation via group policy. Additionally, it improves monitoring capabilities for organizations by allowing better oversight of short-lived privileged accounts.
