Windows Update KB5120998 Causing Group Policy Refresh Failure and Enabling Administrator Protection on Windows 11

[u/certifiedsysadmin]

Hi All,

The following update for Windows 11 released August 27, 2026:

https://support.microsoft.com/en-us/servicing/os/windows-11/2026/08/kb5120998-windows-11-24h2-25h2-update

Also included in the following update for Windows 11 released September 8, 2026 (thanks u/Dissy614):

https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5124008-windows-11-24h2-25h2-security-update

Is causing Administrator Protection to be gradually enabled:

https://techcommunity.microsoft.com/blog/windows-itpro-blog/administrator-protection-on-windows-11/4303482

If you don't know what Administrator Protection is, it essentaly enhances the separation between your elevated vs not elevated context, including giving your elevated context its own profile.

• Under a non-elevated context, whoami will return DOMAIN\user, and your profile with be C:\Users\<username>.
• Under an elevated context, whoami will return DOMAIN\ admin_ <username>, and your profile with be C:\Users\ ADMIN_ <username>.

Conditions:

If you have downloaded/configured the Windows 11 Security Baselines GPO, or you have otherwise set the following policy: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\TypeOfAdminApprovalMode=2

Then this will cause three issues:

1. Computer Group Policy refresh fails.
2. User Account Control (UAC) prompts require user name and password.
3. Group Policy Management Console resulting settings shows the setting on an existing policy, but in the "other" section rather than the "User Account Control" section, if you are viewing from Group Policy Management Console on Windows Server rather than from Group Policy Management Console on Windows 11.

As noted in the first link, enabling Administrator Protection is listed as a gradual rollout, meaning this is not affecting every Windows 11 computer with TypeOfAdminApprovalMode configured.

Fix:

The temporary fix is to set this regkey and reboot:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\TypeOfAdminApprovalMode=1

This only started affecting my machines today, I assume due to the gradual rollout. I don't know how to determine the rollout schedule.

[u/CPAtech]

This is a preview update......

[u/No_Yesterday_3260 → u/CPAtech]

And a 2 month old update.
Interesting - Guess troubleshooting has taken some time.

[u/Dissy614]

"I don't know how to determine the rollout schedule."

Previews are optionally available at the end of a month, and are included as mandatory in the next cumulative update which will be on a standard patch tuesday.

In your first link, look at the left side listing of updates. This one with "preview" is highlighted. Look above for the first without any special tags.

First I see is kb5124008 Sept. 8th - https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5124008-windows-11-24h2-25h2-security-update

Which says at the top: "This update includes improvements from the following previously released updates: August 27, 2026-KB5120998 (OS Builds 26200.9278 and 26100.9278)"

So this was rolled out last months patch Tuesday

[u/BrentNewland → u/Dissy614]

Preview updates have started becoming mandatory from what I've seen. They just install themselves and don't give you any option to decline them.

[u/certifiedsysadmin → u/Dissy614]

Thanks for this 🙏 I've updated the post text with this info.

[u/Pombolina]

From Administrator protection | Microsoft Learn
"If your organization uses Windows security baselines, Administrator protection becomes enabled by default with the October 2026 Windows security update."

So, they announced this feature in Nov 2024, published the security baselines in Sep 2025, and spent the last year not testing that it works on domain joined PCs? sigh.

[u/reddit_username2021]

Random redditor saves the world once again. Thank you

[u/RokosModernBasilisk]

What enterprise environment does not have separate administrative accounts?

[u/certifiedsysadmin → u/RokosModernBasilisk]

Has nothing to do with administrative account separation. We are using separation already. But when you login using your separate admin account, most apps (example PowerShell) run non-elevated unless you run as administrator.

Non-elevated admin account = business as usual

Elevated admin account = newly separated profile

Again this is off by default but if you've implemented Windows 11 Security Baselines it will be gradually turned on.

[u/BrentNewland → u/certifiedsysadmin]

I've had an issue connecting to SharePoint PowerShell from PowerShell ISE in the last week or so. I run PowerShell ISE as a different user (domain admin account) because my scripts need to work with AD.

After a bunch of troubleshooting, it came down to the fact that Edge is no longer allowing child processes to be made when running as admin, and the SharePoint module login apparently uses Edge (unlike the Graph login). Error 200 "unable to launch child processes due to a Group Policy", even though we don't have any such group policy.

Sure enough, launching msedge from an elevated PowerShell ISE session gives that error, but launching Edge with the --no-sandbox argument allows it to work fine.

I'm wondering if this might be related to the change you're talking about.

[u/Pombolina]

I have not been able to reproduce the issues in my test environment using the October update. Running gpupdate.exe /force completes without error, and Admin Approval Mode is enabled and working.

That said, I plan to disable it before approving the October update, just to be cautious.

Am I the only one seeing it behave as expected? It's possible the October update corrected something that was broken in previous updates.

[u/certifiedsysadmin → u/Pombolina]

As mentioned in the post and the update notes, the new behavior of Admin Approval Mode is under gradual rollout.

Installing the update installs the functionality, but Microsoft turns on the new behavior at a time of their choosing.

We saw this enabled on ~2% of the devices that installed the update.

[u/Pombolina → u/certifiedsysadmin]

On my test systems, I have enabled the Microsoft security baselines (which set TypeOfAdminApprovalMode=2)

I confirmed that Admin Approval mode was active on all of them. Well, I assume:

• The UAC prompt asks for credentials instead of simple yes/no
• The elevated token creates and uses the C:\Users\ADMIN_username profile folder
• whomai shows pcname\admin_username instead of domain\username

Group policy refresh works normally.

Are you still experiencing the problem, on your ~2%, with the October update?

[u/Andrew_Forfa]

Try changing "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" To 5 (Prompt for consent for non-Windows binaries)

And wait for patch Tuesday)