Windows Settings: Red-check vs Green-check

Introduction

A brief overview of how Admin By Request (ABR) manages Windows Settings that require administrative privileges.

Issue

Reports have indicated that ABR disrupts certain features within Windows Settings, both in Windows 10 and Windows 11. Specifically, features such as removing a device (Settings > Bluetooth & devices > Devices > Ellipsis) and adding optional features (Settings > System > Optional features > View features) appear inaccessible for users with green-check icons. This issue persists regardless of whether these users are in an active ABR admin session, while red-check users seem unaffected.

Attempts to pre-approve Microsoft vendors, certificates, and SystemSettings executables have not resolved the problem. A workaround exists for device removal on Windows 10 via Control Panel > Hardware and Sound > Devices and Printers, but this option is no longer available in Windows 11.

In previous instances, ABR has caused issues with other applications, and resolving these problems could improve overall compatibility in the environment.

Explanation

The limitations observed with green-check users being unable to access certain features in Windows Settings are expected due to how Windows manages privileges. Features like device removal and adding optional features are generally restricted to users with administrative rights. This behavior is not caused by ABR breaking functionality but reflects Windows' default handling of access levels for standard users.

Logging into a system as a standard user without Admin By Request would produce the same experience. Windows, especially in settings like the Control Panel, applies access levels based on the user’s privileges at logon. Since ABR dynamically elevates privileges as needed, it cannot modify these pre-set access levels. This limitation is currently beyond ABR’s control.

In most cases, the options remain visible, but attempting to access them prompts a User Account Control (UAC) dialog for admin credentials. These credentials can be provided during an active ABR session. Developers are aware of this limitation, and a more seamless integration with Windows Settings is on ABR's development roadmap.

As a workaround, optional features can still be accessed by elevating privileges in the Control Panel through a Tray Tool. Navigating to Control Panel > Programs > Turn Windows features on or off allows access to these settings. Similarly, devices can be managed through Device Manager, accessible via Control Panel or by setting up a Tray Tool targeting hdwwiz.cpl. These solutions provide temporary fixes for managing settings typically restricted to administrators until further updates are made.