Windows 11 Preview Update KB5120998 Adds “Administrator Protection” JIT Feature (Non‑Security Patch)
What Happened — Microsoft released the optional preview cumulative update KB5120998 for Windows 11 25H2/24H2. The build delivers 35 quality‑of‑life changes (taskbar, Start menu, search indexing) and introduces an “Administrator protection” feature that enables just‑in‑time (JIT) elevation of privileges via Intune or Group Policy. The update does not contain security fixes and must be manually installed.
Why It Matters for Compliance & Audit Readiness
- The JIT admin‑protection capability directly supports SOC 2 CC6.1 (least‑privilege) and CC6.2 (privilege‑escalation monitoring) controls; organizations should document its configuration as evidence of access‑control hardening.
- Because the feature is optional and off‑by‑default, auditors will look for a formal policy and change‑management record showing when and why it is enabled.
- Continuous‑compliance programs can capture the Intune/Group‑Policy OMA‑URI settings as immutable audit artifacts, reducing gaps in privilege‑escalation defenses.
Who Is Affected — Enterprises across all sectors that deploy Windows 11 on employee workstations, especially those pursuing or maintaining SOC 2 certification.
Recommended Actions
- Review the “Administrator protection” OMA‑URI settings and decide whether JIT elevation aligns with your least‑privilege policy.
- If enabled, map the configuration to SOC 2 CC6.1/CC6.2 controls, capture screenshots or configuration exports for audit evidence, and update your access‑control procedures.
- Incorporate the feature into your security‑awareness training to ensure users understand the JIT workflow and reporting requirements.
Source: BleepingComputer
Technical Notes — The update is a preview (non‑security) cumulative patch; it does not contain CVEs. The new admin‑protection feature is toggled via OMA‑URI in Microsoft Intune or Group Policy and is not a formal security boundary but mitigates elevation‑of‑privilege attacks through profile separation. Source: same as above