r/sysadmin • u/Full_Quantity890 Jr. Sysadmin • 1d ago
Question 26H2 admin sign in fails with Administrator Protection enabled. Anyone else seeing this?
Has anyone else run into this?
Troubleshooting a Windows 11 26H2 domain-joined workstation where admin sign-in fails after a reboot. We narrowed it down to:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\TypeOfAdminApprovalMode
- Set to 2, admin sign-in fails after reboot.
- Set to 1, sign-in works again.
The MSFT Windows 11 25H2 - Computer baseline GPO is enforcing 2.
Our DC runs Server 2022, and its Group Policy editor doesn’t show User Account Control: Configure type of Admin Approval Mode under Security Options.
I’m mainly trying to figure out why Administrator Protection is causing this. Changing the value gets us past the issue, but doesn’t explain what’s actually failing.
Has anyone seen similar behavior? Any particular event logs or known compatibility issues worth checking?
Also, would updating the ADMX/ADML files expose this setting in Server 2022’s editor, or is its visibility tied to the Security Settings extension on the OS running GPMC?
I’m not looking to modify the baseline GPO at this point. Just trying to understand the underlying issue and why the setting isn’t visible.
2
u/skeetgw2 Idk I fix things 1d ago
You may need to update your admx templates to get the GPO? Not personally seeing this issue but articles are popping up pretty quickly about it.
1
u/Competitive-Debt7226 1d ago
admx templates are always the first thing to check when a new policy is missing from the editor, that's definitely step one
for the sign-in failure itself, event viewer under applications and services logs > microsoft > windows > user account control might have something. usually a 5120 or 5122 event pops up when admin approval mode blocks something at the kernel level
also worth checking if credential guard or any third-party auth providers are running, those don't always play nice with the newer admin protection sandbox in 26h2
1
u/SteveSyfuhs Builder of the Auth 1d ago
You haven't posted anything about the sign in that actually failed. All you're saying is "admin sign-in fails". Are you getting an error? What error? Are you seeing failure events? Access denied events? Warnings?
1
u/MarcuquieBurkes 1d ago
been chasing something like this on our pilot ring too, but only on machines that came from an in place upgrade, fresh images seem fine. does the failure follow the user profile or the box itself when you swap accounts?
1
u/Full_Quantity890 Jr. Sysadmin 1d ago
Just that admin account on the computer. Get the error "The specified account does not exist." Signing in elsewhere is fine. Other accounts sign in just fine. Also noticed when trying to elevate apps to run as admin those same credentials dont work. Doesn't even see it. Quite strange.
1
u/MarcuquieBurkes 1d ago
yeah that lines up with what i ran into, the account just kind of goes invisible to elevation even though it clearly exists. have you checked if it's still sitting in the local admins group? when i hit this the account had somehow fallen out of it after the update.
•
u/BorysTheBlazer StarWind 11h ago
That error sounds like Administrator Protection's hidden system-managed admin account missing for your user. Check whether it got orphaned in the upgrade.
1
u/certifiedsysadmin Azure Infra / Identity / Security / Hyper-V 1d ago
Similar or possibly the same issue:
•
u/slackjack2014 Sysadmin 20h ago
To get the updated GPO settings, add the ADMX files to the SYVOL\<domain>\Policies\PolicyDefinitions folder to gain access to them on Server 2022.
I ran into this a while ago back when Microsoft introduced Admin Approval Mode. It broke elevation for us, but even when I changed the GPO setting “User Account Control: Configure type of Admin Approval Mode” to Legacy Mode, the Windows Security Baseline we imported took priority. It was hard-coded in the GPO, I ended up manually editing the GPO in the SYSVOL to stop it setting TypeOfAdminApprovalMode to 2.
•
7
u/insightrecon Jack of All Trades 1d ago
ADMX won’t add it. It’s a Security Option. Those come from the OS of whatever box you’re running GPMC on (sceregvl.inf). Server 2022 just doesn’t know about it. Edit the GPO from a patched Win 11 machine with RSAT and it will show up.
Not sure on the sign-in but Microsoft’s Admin Protection page says roaming profiles and “backup admins” aren’t supported. If that admin account roams I’d start there.