As reported by BleepingComputer, Microsoft's KB5120998 preview cumulative update for Windows 11 versions 25H2 and 24H2 ships with 35 changes — but the standout from a security perspective is the initial rollout of the Administrator Protection feature, which introduces just-in-time privilege elevation for administrative tasks.

Security Impact: As reported by BleepingComputer, Microsoft's KB5120998 preview cumulative update for Windows 11 versions 25H2 and 24H2 ships with 35 changes — but the standout from a security perspective is the initial rollout of the Administrator Protection feature, which introduces just-in-time privilege elevation for administrative tasks.

This is the development that should catch defenders' attention, not the taskbar repositioning or Start menu resizing that dominate the headline. Administrator Protection represents a meaningful architectural shift in how Windows handles privileged operations, and security teams should begin evaluating it now — before it reaches general availability on Patch Tuesday.

What Administrator Protection Actually Does

Microsoft describes the feature as providing profile separation for administrative tasks. In practice, this means users can perform admin operations using temporarily granted, just-in-time privileges rather than running with standing administrative rights. The principle mirrors what privileged access management (PAM) solutions have advocated for years: reduce the attack surface by minimizing the window during which elevated permissions are active.

Microsoft notes: "Administrator protection is not classified as a formal security boundary; it hardens the security against elevation-of-privilege attacks with the introduction of profile separation."

The company's caveat — that this is not a formal security boundary — is important. Microsoft's security boundary commitments carry specific guarantees around patching and support. Administrator Protection sits below that threshold, meaning it should be treated as defense-in-depth hardening, not as a replacement for existing controls like EDR, application control, or least-privilege tooling.

Why This Matters for Enterprise Defenders

Elevation-of-privilege (EoP) remains one of the most common steps in both ransomware and APT kill chains. Attackers who land on a endpoint with standard user rights typically need to escalate — via unpatched kernel bugs, misconfigured services, or credential theft — before they can disable security tooling, install persistence, or move laterally. Any feature that narrows the window for standing admin privileges directly impacts that workflow.

However, the feature is disabled by default and must be enabled via Microsoft Intune (OMA-URI) or Group Policy. Organizations that fail to consciously opt in will see zero benefit. This is the classic pattern with Windows security features — from Attack Surface Reduction to Credential Guard — where valuable protections sit unused because no one toggles them on.

Key Details

AttributeDetail
UpdateKB5120998 (preview, non-security)
Affected OSWindows 11 25H2 (build 26200.9278), 24H2 (build 26100.9278)
FeatureAdministrator Protection (just-in-time privilege elevation)
Default StateDisabled
EnforcementIntune OMA-URI or Group Policy
Security BoundaryNo — hardening only
Active ExploitationN/A — feature rollout, not a vulnerability patch

Shield53 Recommendations

Shield53 Recommendations
Pilot now in a controlled OU: Since KB5120998 is a preview update, deploy to a small group of test devices. Enable Administrator Protection via Intune or GPO and monitor for application compatibility issues, particularly with legacy installers and management agents that assume standing admin rights.
Audit standing admin accounts: Before the feature reaches general availability, inventory all accounts with local admin or domain admin privileges. Identify candidates who could transition to just-in-time elevation. This baseline will make rollout measurable.
Update your endpoint hardening baselines: Revise your CIS or custom Windows 11 baselines to include Administrator Protection as a recommended control once it hits GA. Document the Intune OMA-URI and GPO settings in your configuration management database.
Set detection expectations: Coordinate with your SOC on what just-in-time privilege elevation events will look like in your SIEM. Ensure logging captures privilege grant and revocation so analysts can distinguish legitimate admin activity from anomalous patterns.
Do not treat it as a boundary: Maintain EDR, application allow-listing, and PAM tooling. Administrator Protection is complementary hardening — not a replacement for layered defense.

Microsoft's pattern of shipping valuable security features silently inside optional updates is well established. The organizations that benefit most are the ones paying attention before Patch Tuesday forces the conversation. This is one worth watching.