Windows 11’s Administrator Protection Is Breaking GOG’s Classic Games

Microsoft pulled Administrator Protection off every Windows 11 PC in December 2025 after the security feature broke something badly enough to force a fleetwide rollback. Seven months later, GOG says the same feature is mangling video games from the 1990s.

Michał Obuchowski, GOG’s publishing technical manager, laid out the problem to RPG Site in an interview published this month. The overlap is not a coincidence of timing so much as a pattern: a security overhaul built to close credential-theft holes keeps colliding with software Microsoft never tested against it, whether that software shipped in 1998 or 2026.

Administrator Protection Swaps One Click for a Hidden Account

For three decades, Windows asked one question when a program wanted administrator rights: click Yes or don’t. User Account Control, introduced in Vista, handed the logged-in user both a standard token and an admin token at sign-in, and elevation just meant switching to the one already sitting there.

Administrator Protection throws that model out. Obuchowski described it to RPG Site as a system where the system spins up a hidden, one-time admin account and a short-lived token gated behind Windows Hello. No standing admin token exists to steal. Microsoft’s own documentation frames it as a platform feature that grants elevation only after explicit, just-in-time approval, then discards the privilege the moment the task finishes.

The design closes a real gap. Security researchers have spent years cataloguing UAC auto-elevation bypasses that let malware quietly gain administrator rights without ever showing a prompt.

The CrowdStrike Crash That Justified It

Administrator Protection did not appear in a vacuum. Microsoft unveiled it at Ignite in November 2024 as part of the Windows Resiliency Initiative, months after a faulty CrowdStrike update crashed Windows machines worldwide. Reporting at the time pegged the damage at over 8 million Windows PCs and servers grounded, at an estimated cost of 5.4 billion dollars.

David Weston, Microsoft’s corporate vice president for enterprise and OS security, explained the new account model to creating two accounts for every single user, one standard and one isolated admin account that only exists for a task and then disappears. Gartner analyst Chris Silva backed the underlying logic, arguing that tying elevated rights to specific, time-boxed tasks is exactly how organizations should be closing off credential-based attacks.

Weston told DarkReading the feature would be on by default by the end of 2025. Instead, Microsoft spent that December pulling it from every retail and Insider machine running Windows 11.

Did Microsoft Actually Fix Administrator Protection?

Partly. Microsoft disabled Administrator Protection across Windows 11 in December 2025 after finding a reliability problem, patched nine separate bypasses that Google’s security researchers had reported, then resumed a gradual rollout in early 2026. It still is not the default setting on most PCs.

1. November 2024: Microsoft announces Administrator Protection at Ignite as part of the Windows Resiliency Initiative.
2. May 2025: Microsoft confirms the feature is expanding beyond commercial customers to consumer Windows 11 devices.
3. October 2025: Administrator Protection ships in optional update KB5067036, then gets reverted.
4. December 2025: Microsoft disables Administrator Protection fleetwide after uncovering a reliability issue.
5. January 2026: Google’s Project Zero discloses nine separate bypass techniques found during the insider preview, all since patched.
6. March 2026: Microsoft resumes the rollout and adds a Settings toggle for IT admins and consumers.

Microsoft’s own account of the shutdown was blunt. A Windows Developer Blog update acknowledged that a reliability issue behind the fleetwide disable forced the company’s hand.

We uncovered a reliability issue and disabled Administrator protection from retail and Windows Insiders channels to ensure that it meets our commitments to both security and reliability.

That is Microsoft’s own Windows Developer Blog, not a third party. Google’s Project Zero separately found nine separate ways to bypass the feature and silently grab full administrator rights during the insider preview, all fixed before or shortly after release.

GOG’s List of Casualties Includes DirectShow and DirectPlay

Obuchowski’s complaint to RPG Site was not really about the login prompt. It was about everything underneath it. Windows, he argued, carries three decades of legacy code, and Microsoft keeps trimming pieces of it loose.

• DirectShow: a regression in newer Windows 11 builds broke playback of classic game cutscenes and intro videos, the multimedia framework dating back to Windows 95.
• DirectPlay: the old multiplayer networking API is deprecated and now needs wrapping in a custom DLL stub, or a title may not even start.
• Legacy drivers: hardware drivers written for operating systems Microsoft no longer actively supports, complicating installs on decades-old titles.
• Old copy protection: DRM schemes from the era that are difficult to strip out, which Obuchowski said makes shipping games DRM-free more important, not less.

GOG is not new to this fight. The storefront has restored relatively obscure titles like Ecstatica and Clive Barker’s Undying to a playable, purchasable state, alongside genre landmarks such as the first three Resident Evil games. Retiring old Windows components is not unique to gaming either; Microsoft’s printer driver deadline that already passed this month follows the same pattern in a completely different corner of the OS.

SteelSeries Just Learned What GOG Already Knew

The friction is not confined to 1990s software. Users running SteelSeries’ GG peripheral configuration tool on Windows 11 25H2 Insider builds reported it failing to launch entirely once Administrator Protection was switched on, a problem tied to elevated process spawning and driver initialization under the new security model, according to Microsoft’s own support forum.

That is a program built for current hardware, released this decade, tripping over the exact mechanism GOG is describing for decades-old installers. Obuchowski told RPG Site that Microsoft does not publish what changed under the hood until it ships a preview build, leaving developers guessing at what broke and why until testers stumble onto it.

GOG’s Answer Is Simpler Than Patching Forever

GOG’s response has never been to chase every Windows update with a fix. Piotr Gnyp, the storefront’s senior PR lead, told RPG Site that Microsoft is still gradually rolling the toggle out through 2026 Insider builds, with no fixed date for the feature to go fully default.

Gnyp put GOG’s philosophy simply: “Today’s releases are tomorrow’s classics,” he said, arguing that a game sold as a keepable, offline, DRM-free installer is far easier to maintain across thirty years of Windows changes than one locked behind always-online DRM. The company rebranded from Good Old Games to GOG.com in 2010 specifically to shed the idea that preservation was only about the past.

Every Windows update that quietly breaks a driver or a video codec adds one more argument for that approach. GOG’s Preservation Program and its newer Dreamlist initiative exist because Microsoft’s next security push is not going to wait for old software to catch up.

Frequently Asked Questions

Is Administrator Protection Turned on by Default in Windows 11?

No. As of the most recent Windows Insider builds, Administrator Protection remains an opt-in toggle rather than a default setting, reachable through Settings, then Privacy & Security, then Windows Security, then Account Protection.

How Do I Turn Off Administrator Protection If It Breaks a Program?

The feature can be switched off from the same Settings menu, or by editing the TypeOfAdminApprovalMode registry key back to its default value, a process Windows Central has documented step by step.

What Is GOG’s Preservation Program?

It is GOG’s ongoing effort to keep older PC games running on current hardware and operating systems, distinct from the newer Dreamlist initiative and the storefront’s One-Click Mod system, both aimed at long-term playability rather than new releases.

Did Microsoft Explain What Broke in December 2025?

Not in detail. Microsoft’s public statement called it a reliability issue without naming the affected applications, the same lack of specifics Obuchowski said makes it hard for developers to prepare before a preview build ships.