Skip to main content

162: Account & Administrator Protection

Implementation Effort: Low – Configured through Intune Endpoint Security Account Protection profiles and Settings Catalog.

User Impact: Low to Medium – Transparent for standard tasks; when Administrator Protection is enabled, users must authenticate with Windows Hello (biometrics/PIN) for just-in-time elevation prompts.

Overview​

Account protection in Microsoft Intune's Endpoint Security node protects user identities, credentials, and local administrator privileges on Windows devices. It encompasses:

  • Windows Hello for Business (WHfB): Replaces passwords with strong, hardware-backed two-factor authentication using biometrics or PINs.
  • Credential Guard: Uses virtualization-based security (VBS) to isolate and protect secrets and credentials from theft.
  • Administrator Protection on Windows 11 (2026 Update): Adds two new settings to the Endpoint Security Account Protection profile (User Account Control Type Of Admin Approval Mode and User Account Control Behavior Of The Elevation Prompt For Administrator Protection). Administrator Protection enforces true least privilege by keeping users in a standard user token and generating a profile-isolated, just-in-time admin token only after interactive user authentication (such as Windows Hello) for each administrator-level action—preventing silent malware privilege escalation.
  • Local User Group Membership: Controls members of built-in local groups (such as Administrators) to strip standing local admin rights.

This supports Use least privilege access and Verify explicitly by eliminating standing administrative tokens and requiring explicit biometric/PIN verification for every elevation.

Implementation Guidance​

Define the identity and privilege model​

  • Decide whether users should operate without standing local administrator rights and document the approved elevation path for exceptions.
  • Choose whether Windows Hello for Business will be cloud Kerberos trust, key trust, or certificate trust based on identity dependencies and business requirements.
  • Identify which devices need Windows LAPS and how recovery passwords will be accessed, audited, and rotated.

Configure policies in Intune​

  • Use endpoint security Account protection policies in the Microsoft Intune admin center for Windows Hello for Business, local group membership, and Windows LAPS-related settings where supported.
  • Restrict membership in the local Administrators group to approved identities or groups instead of relying on ad hoc support practices.
  • Validate Credential Guard or related virtualization-based protections against application compatibility requirements before broad rollout.

Operate with least privilege​

  • Monitor LAPS rotation health, local group membership drift, and enrollment failures for passwordless sign-in scenarios.
  • Integrate privileged access controls with Entra role protection, Conditional Access, and helpdesk support procedures.
  • Review exception devices regularly so permanent local admin access does not quietly expand over time.

Reference​