User Account Control: Admin Approval Mode for the Built-in Administrator account
Setting the `FilterAdministratorToken` DWORD value to `1` places only the built-in Administrator account—the local account with relative identifier (RID) `500`—in User Account Control (UAC) Admin Approval Mode.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken
Setting the FilterAdministratorToken DWORD value to 1 places only the built-in Administrator account—the local account with relative identifier (RID) 500—in User Account Control (UAC) Admin Approval Mode.
The account consequently runs ordinary applications without automatically activating its administrative privileges. When an operation requests elevation, Windows can display a UAC prompt that allows the user to approve or deny the request. Once approved, the affected process runs with the highest privileges available to the account.
Notes
Security
This setting reduces the risk of applications running unnoticed with the full privileges of the built-in Administrator account. It does not remove the account's administrative privileges or prevent elevation: an approved process receives elevated privileges.
The effective protection also depends on the other UAC policies. In particular, the elevation-prompt policy for administrators determines whether elevation requires consent or credentials, or can proceed without prompting.
Possible side effects
Users signed in with the built-in Administrator account encounter additional UAC prompts for operations that require elevated privileges. Applications and administrative tasks that previously ran immediately with full administrative privileges can require explicit approval or fail to operate fully when elevation is denied.
Notes
The value applies only to the built-in Administrator account with RID 500, even if that account has been renamed. It does not directly change UAC behavior for other accounts that belong to the local Administrators group.
This value is part of the UAC configuration. If Admin Approval Mode is disabled system-wide through EnableLUA, the related UAC policies are also disabled. An existing sign-in session might need to be renewed before the changed behavior applies fully.
Microsoft documentation
Microsoft Learn: User Account Control—Admin Approval Mode for the Built-in Administrator account
Microsoft Learn: MS-GPSB—FilterAdministratorToken