Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Is Killing Enterprise Local Admin Rights
Transcript
- Lucas: So Microsoft is finally doing something that enterprise security teams have been screaming for, for about fifteen years. They are making the default that users do not have local administrator rights on Windows 11 machines. Luna: Wait — they weren't already doing that? I thought best practice was no admin rights for standard users. Lucas: Best practice, yes. But Microsoft never enforced it at the OS level. The built-in Administrator account was always there, and countless IT departments just left it enabled because it was easier. You know the calculus: give everyone admin rights, save the help desk calls, accept the risk. Luna: Right, and that risk is huge. One phishing click and the attacker has full system control. Lucas: Exactly. So with Windows 11 version 24H2, which started rolling out late last year, Microsoft introduced what they call 'user mode' for local admin. It's not just a policy recommendation. It's a fundamental architectural change. The OS now treats the built-in Administrator account as a 'protected account' — it's disabled by default on new installs, and even if you enable it, it can't run legacy unauthenticated apps. Luna: That's a big shift. What about the apps that genuinely need admin rights — like old accounting software or custom line of business apps? Lucas: That's the friction point. Microsoft's answer is Windows Defender Application Guard for Local Admin. It lets you elevate a single app's privileges temporarily without giving the user full admin rights. Think of it as a sandbox: the app thinks it has admin access, but the OS isolates it. It's similar to how Application Guard works for Edge, but now for legacy Win32 apps. Luna: So the user gets a prompt, like a UAC dialog but actually smart? Lucas: Yes, but with a key difference. The old UAC prompt was basically a rubber stamp — most users clicked 'Yes' without thinking. The new system integrates with Azure AD and Microsoft Entra ID. It can require a justification, a second factor, or even a manager approval via a ticketing system. Luna: That's just-in-time elevation, essentially. Lucas: Exactly. It's the same principle as LAPS — Local Administrator Password Solution — which Microsoft has had for years, but now it's built directly into Windows 11 Pro and Enterprise. IT can set policies like 'this user can only elevate for 15 minutes, only between 9 AM and 5 PM, and only for this specific app.' Luna: What about shops that aren't on Azure AD? Pure on-premises Active Directory? Lucas: They can still use LAPS, which rotates the local admin password and stores it in AD. But the new user-mode protection is cloud-dependent for its full intelligence. Microsoft is clearly pushing hybrid or cloud-joined setups. For on-prem only, you lose the contextual approvals. Luna: That's going to be a hard sell for some organizations. I'm thinking of a mid-sized insurance firm I spoke with last month. They had 1,200 employees, and 90 percent of them had local admin rights — just because the legacy claims software required it. Lucas: Classic case. So what'd they do? Luna: They started a pilot with Windows 11 and Application Guard for that one legacy app. They removed admin rights for 95 percent of users. The other 5 percent — IT staff and a few power users — they used LAPS with time-limited passwords. Their security incidents dropped by 80 percent in the first six months. Lucas: That's the kind of data point that gets CFOs on board. The help desk ticket volume initially spiked — users couldn't install printers or change time zones — but after a month it normalized. The key is communication. You can't just flip the switch. Luna: What about third-party vendors like CyberArk or BeyondTrust? Are they being displaced? Lucas: Not entirely. Microsoft's built-in solution is good for basic just-in-time elevation and LAPS. But CyberArk and BeyondTrust offer much finer-grained controls — like session recording, keystroke logging, and privileged session management for SSH and RDP. Those are still relevant for high-risk admin accounts. But for standard users? Microsoft's solution is now robust enough that you might not need a third-party add-on. Luna: So the bar is rising. If you're a CISO and you're not planning to remove local admin rights with Windows 11, you're basically accepting unnecessary risk. Lucas: Yes, and Microsoft is making it harder to ignore. Starting with Windows 11 24H2, they've also hardened the Local Security Authority subsystem. If an attacker tries to dump the local admin hash, the OS can detect that and force a reboot or trigger a tamper alert. Luna: Let's talk about the user experience side. When I first heard about this, I thought — great, but what about the intern who needs to install Zoom or update their VPN client? Lucas: Right. Microsoft is solving that with the new 'Microsoft Store for Business' integration. Approved apps can be silently installed via Intune or Configuration Manager without admin rights. And for one-off installs, the user can request elevation through a self-service portal that IT can approve or deny. Luna: That shifts the burden from 'just give them admin' to 'have a proper software lifecycle management process.' Lucas: Exactly. Which is where a lot of enterprises have been weak. The ones that already had good software packaging and deployment will barely feel the change. The ones that relied on users installing whatever they needed — those are the ones that will struggle. Luna: I wonder about the long tail of legacy apps from the XP era. There are still Windows 7 apps in some factories and hospitals that require local admin and won't run in a sandbox. Lucas: Those are edge cases that will need virtualization or containerization. Microsoft would say — and I'm not entirely unsympathetic — that if an app is twenty years old and requires full admin rights, maybe it's time to modernize it. But I know that's not always feasible. Luna: So what's the pragmatic path for an IT director listening to this? First step? Lucas: Audit your environment. Use tools like the Microsoft Local Admin Password Solution to inventory which machines still have the built-in admin account enabled. Then pilot a group of willing users — start with a department that has low application complexity. Use Group Policy or Intune to deploy the new user-mode restriction. Monitor help desk tickets closely for the first month. Luna: And for the apps that break, you create a list and work with the vendor or use Application Guard. Lucas: Right. And if you're a small business without a dedicated IT team, Microsoft 365 Business Premium includes Azure AD PIM, which can grant temporary admin roles via a simple approval workflow. You don't need to be a Fortune 500 to do this. Luna: It's interesting how this change is really about culture as much as technology. Moving from 'trust but verify' to 'zero trust by default.' Lucas: Exactly. And speaking of trust — you know, this show is ad-free and listener-supported. If this conversation gave you something actionable, consider supporting us at buy me a coffee dot com slash fexingo. That's 'buy me a coffee dot com slash fexingo.' A small one-time contribution helps us keep the lights on and avoid selling your attention to advertisers. Luna: Yeah, we really appreciate everyone who chips in. It lets us stay independent and focus on the details that matter. Lucas: Alright, back to the technical side. One more thing about Windows 11 24H2 that's relevant here: the new 'Smart App Control' feature. It uses AI to predict whether an app needs admin rights and can automatically grant elevation if it trusts the app, without a prompt. Luna: That's interesting — it's like a whitelist that builds itself over time. Lucas: Yes. It's based on Microsoft's Intelligent Security Graph. If the app has a good reputation, it runs elevated silently. If it's unknown, the user sees a block. That reduces the friction for trusted apps while still blocking malicious ones. Luna: It's a smart middle ground. Not all or nothing. Lucas: Exactly. And that's the direction Microsoft is taking — making security less of a binary choice and more of a contextual continuum. For IT teams, the message is clear: start planning your local admin removal now, because the Windows 11 train is leaving the station.