STRENGTHENING LOCAL ADMIN SECURITY IN WINDOWS 11 WITH LOCAL ADMIN PROTECTION

Summary from the TLDR InfoSec newsletter

When using a local admin account in Windows, users are provided with both a limited user token and an elevated admin token which can potentially be stolen by malware on the system. Windows 11 recently introduced the Local Admin Protection or ShadowAdmin protection to solve this issue. In this system, a ShadowAdmin account is created for each local admin account, and when a process needs admin privileges, the task is run in an isolated context by the ShadowAdmin user. This post includes instructions to enable the feature and detailed technical details of how the Local Admin Protection flow works.