User Role set to Global Administrator but when prompted for Admin Username and Profile, it tells me 'the requested operation requires elevation"

Question

User Role set to Global Administrator but when prompted for Admin Username and Profile, it tells me 'the requested operation requires elevation"

RBR 0

trying to change User Account Control settings, but when I go to enter admin username and profile, it tells me 'the requested operation requires elevation". The username and password I am entering is my profile email address and password for Windows 11. My role is set to Global administrator, trying to determine what I need to do to make admin changes to computer settings.

Thanks!

3 answers

Your answer

Answer 1

Hello RBR,

I am checking in to see if you have successfully regained administrative access on your device. As we identified, the persistence of "Standard User" restrictions even after a full reset indicates that the device is pulling a restrictive policy from the cloud during setup. The resolution relies on logging into https://www.google.com/search?q=intune.microsoft.com to update the Windows Autopilot Deployment Profile—specifically changing the "User account type" from Standard to Administrator, and verifying your role assignment in https://www.google.com/search?q=entra.microsoft.com under Device Settings. Once those cloud policies are updated, the final "Remove everything" reset will force the device to download the new configuration and correctly apply your Global Administrator privileges.

If the issue has been successfully resolved, please consider accepting the answer as it helps other people sharing the same question benefit too. Thank you!

VP

Answer 2

VPHAN 21,275 Independent Advisor

Hello RBR,

First, attempt to force the UAC prompt to recognize the domain context by entering your username in the specific format AzureAD\YourFullEmailAddress (e.g., AzureAD\******@domain.com). This syntax explicitly tells the Local Security Authority to validate the request against your Azure AD credentials rather than a local account. Additionally, if your organization uses Privileged Identity Management (PIM), ensure your Global Administrator role is currently "Active" in the Azure portal. If the role was eligible but not active when you logged in, the device would grant you only Standard User rights.

If the AzureAD\ prefix fails and you have no other administrator accounts on the device to elevate you, you are in a "lost administrative access" state. You cannot change UAC settings or add yourself to groups because you lack the initial token to perform those actions. The only supported resolution that preserves your data is to reset the device to re-establish the trust relationship. Go to Settings > System > Recovery > Reset this PC and select Keep my files. This will reinstall Windows 11 and, during the setup phase (OOBE), will re-evaluate your Global Administrator status and correctly add you to the local Administrators group.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

VP

RBR 0 Reputation points

2026-01-12T20:22:43.5433333+00:00

Thanks VP, however, using the Azure syntax did not work and attempting the reset PC did not work - resetting the PC still requires Admin rights which is not working for me. any other thoughts?
VPHAN 21,275 Reputation points Independent Advisor

2026-01-12T20:26:40.1833333+00:00

You can try performing a "Shift + Restart" maneuver. At the Windows sign-in screen (where you enter your password), press and hold the Shift key on your keyboard, then click the Power button on the screen and select Restart. Keep holding Shift until you see a blue screen labeled "Choose an option." Once there, navigate to Troubleshoot > Reset this PC. You can attempt to select "Keep my files" here. Because this environment runs outside the active Windows kernel session, it often permits a reset when the OS interface does not.

Be aware that if your drive is encrypted with BitLocker, the system will ask for the 48-digit recovery key before proceeding. As a Global Administrator, you or your IT department can locate this key in the Microsoft Entra (Azure AD) portal under the device's object, or at aka.ms/myrecoverykey associated with the account that originally joined the device.

If the Recovery Environment also blocks you by demanding a local administrator password that it refuses to accept, your local Security Account Manager (SAM) database is likely corrupted or completely desynchronized from Entra ID. In that specific scenario, the only remaining technical solution is to create a Windows 11 installation USB on a different computer, boot this device from that USB, and perform a clean installation of Windows. This wipes the existing OS partition and forces a fresh join to Azure AD, correctly applying your Global Administrator privileges from scratch.
RBR 0 Reputation points

2026-01-13T18:02:50.7766667+00:00

I was able to reset the PC with the recovery key, but it did not take me through the set-up process. Still having the same issue. any other thoughts?
VPHAN 21,275 Reputation points Independent Advisor

2026-01-14T08:45:27.19+00:00

You must perform a destructive reset to force the "Out-of-Box Experience" (OOBE). This is the specific phase where Windows negotiates with Microsoft Entra ID (Azure AD) to apply your Global Administrator privileges to the local machine. First, back up your critical data to an external drive or cloud storage, as your current Standard access still allows you to copy files. Once your data is secured, return to the Recovery Environment via Shift + Restart, navigate to Troubleshoot > Reset this PC, and strictly select Remove everything. If prompted, choose Cloud Download to ensure the integrity of the system image. This process will wipe the drive and, upon restart, present the region and language selection screen. When you subsequently sign in with your Global Administrator credentials, the device will create a pristine profile and correctly place you in the local Administrators group.
RBR 0 Reputation points

2026-01-14T17:37:17.21+00:00

I completed this restart, however it is still not recognizing me as an administrator and is saying the request requires elevation. Confirmed I am still global administrator in Microsoft 365 admin center. Any other steps I should take?
VPHAN 21,275 Reputation points Independent Advisor

2026-01-14T18:01:36.7066667+00:00
Log in to the Microsoft Intune admin center (intune.microsoft.com) from a different device or your browser.

Navigate to Devices > Windows > Windows enrollment > Deployment Profiles.

Select the profile assigned to your device (or the default profile).

Look for the setting User account type. It is almost certainly set to Standard.

Change this setting to Administrator. Save the profile. Note: If you want to keep the policy as Standard for other users but exempt yourself, you will need to create a specific profile for your user/device group.

__Once the policy is updated in the cloud, y__ou must perform the "Reset this PC > Remove everything" process one last time. When the device reaches the OOBE (setup) phase again, it will download the updated profile which now instructs Windows to grant your user account local Administrator privileges during profile creation.

Alternative (Non-Destructive check): In the Microsoft Entra admin center (entra.microsoft.com), go to Devices > Device settings. Ensure that "Global Administrator" is listed under "Manage Additional local administrators on all Microsoft Entra joined devices." If it is missing, add it. However, updates to this specific setting can take up to 4 hours to sync to the device and require a reboot, and they are often superseded by the Autopilot profile mentioned above. The Intune method is the definitive fix.

Answer 3

It seems that you are encountering a User Account Control (UAC) issue while trying to change settings on your Windows 11 device. Even though your role is set to Global Administrator, UAC can still require elevation for certain actions. Here are a few steps you can take to resolve this issue:

Run as Administrator: Make sure that you are running the application or settings you are trying to change with administrative privileges. Right-click on the application and select "Run as administrator".
Check UAC Settings: You might want to check your User Account Control settings to ensure they are configured correctly. You can access these settings through the Control Panel under "User Accounts" > "Change User Account Control settings".
Use the Built-in Administrator Account: If the above steps do not work, you can try enabling and using the built-in Administrator account to make the changes. This account has full administrative privileges and might bypass the elevation requirement.
Group Policy Settings: If your computer is part of a domain, group policies might be affecting your ability to make changes. You may need to contact your IT administrator to check if there are any policies in place that restrict your access.
Verify Credentials: Ensure that the username and password you are entering are correct and that you are using the correct format for the username, especially if it is an email address.

If you continue to experience issues, consider checking for any updates or patches for Windows 11 that might address UAC-related problems.

References:

RBR 0 Reputation points

2026-01-12T17:41:41.36+00:00

I am unable to run items as administrator because it is not accepting the username and password

Share via

User Role set to Global Administrator but when prompted for Admin Username and Profile, it tells me 'the requested operation requires elevation"

3 answers

Your answer