Apply UAC restrictions to local accounts on network logons
This registry value controls UAC access-token filtering when local Security Accounts Manager (SAM) accounts authenticate to the computer through a network logon.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
This registry value controls UAC access-token filtering when local Security Accounts Manager (SAM) accounts authenticate to the computer through a network logon. With type REG_DWORD and value data 0, Windows creates a filtered access token for a local administrator account. Administrative capabilities are removed from the token available to that remote session.
The account consequently operates with standard-user capabilities during the network logon and cannot request elevation within that session. It retains any access granted to its filtered token, so the value does not deny authentication or all network access.
Notes
Security
Token filtering prevents credentials for a local administrator account from immediately providing full administrative authority through an ordinary network logon. This limits certain lateral-movement techniques, including the remote use of compromised local administrator credentials or credentials reused across multiple computers.
The setting is not an account lockout or a network-logon prohibition. Resources that permit access to standard users or to the resulting filtered token remain accessible.
Possible side effects
Remote-management functions that require a full administrator token can fail with an access-denied error even when the supplied credentials are valid. This can affect management over WinRM, WMI, or SMB. In particular, a filtered local account cannot use administrative shares such as C$ or ADMIN$.
Some WMI providers can return incomplete results or no results when the requested information requires administrative authority. Management and migration products that connect by using a local administrator account can likewise lose functionality.
Notes
The value applies to local accounts using network logons. It does not filter every form of administrator sign-in and does not govern an interactive Remote Desktop session in the same way. Domain accounts are not converted into filtered local SAM accounts by this value.
Microsoft documents comprehensive enforcement of remote restrictions for local accounts together with the UAC security options for Admin Approval Mode, including the corresponding option for the built-in Administrator account. This registry value alone should therefore not be interpreted as blocking every remote-access scenario involving every local administrator account.
Microsoft documentation
Microsoft Learn: User Account Control and remote restrictions
Microsoft Learn: Local accounts