![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
robopet3User Account Control: Run all administrators in Admin Approval Mode
https://docs.microsoft.com/en-US/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode
Difference Between UAC and Admin Approval mode RRS feed
https://social.technet.microsoft.com/Forums/windows/en-US/6fe85045-ae27-4741-9412-be283f311d24/difference-between-uac-and-admin-approval-mode?forum=w7itprosecurity
While UAC appears in both Windows Server 2008 and Windows Vista, the default configurations differ in the following ways:
The Admin Approval Mode (AAM), by default, is not enabled for the Built-in Administrator Account in either Windows Server 2008 or Windows Vista.
The Built-in Administrator account is disabled by default in Windows Vista, and the first user account created is placed in the local Administrators group, and AAM is enabled for that account.
The Built-in Administrator account is enabled by default in Windows Server 2008. AAM is disabled for this account.
Admin Approval Mode
Admin Approval Mode (AAM) is a UAC configuration in which a split user access token is created for an administrator. When an administrator logs on to a Windows Server 2008-based computer, the administrator is assigned two separate access tokens. Without AAM, an administrator account receives only one access token, which grants that administrator access to all Windows resources.
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc772207(v=ws.10)?redirectedfrom=MSDN
https://docs.microsoft.com/en-US/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode
Difference Between UAC and Admin Approval mode RRS feed
https://social.technet.microsoft.com/Forums/windows/en-US/6fe85045-ae27-4741-9412-be283f311d24/difference-between-uac-and-admin-approval-mode?forum=w7itprosecurity
While UAC appears in both Windows Server 2008 and Windows Vista, the default configurations differ in the following ways:
The Admin Approval Mode (AAM), by default, is not enabled for the Built-in Administrator Account in either Windows Server 2008 or Windows Vista.
The Built-in Administrator account is disabled by default in Windows Vista, and the first user account created is placed in the local Administrators group, and AAM is enabled for that account.
The Built-in Administrator account is enabled by default in Windows Server 2008. AAM is disabled for this account.
Admin Approval Mode
Admin Approval Mode (AAM) is a UAC configuration in which a split user access token is created for an administrator. When an administrator logs on to a Windows Server 2008-based computer, the administrator is assigned two separate access tokens. Without AAM, an administrator account receives only one access token, which grants that administrator access to all Windows resources.
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc772207(v=ws.10)?redirectedfrom=MSDN
