What to do if…
your device suddenly asks for administrator permission for normal settings changes

What to do now

1. Freeze the moment and record what you see.
   Take a screenshot or phone photo of the prompt, including the app name, publisher, file path, and any warning text. Write down what you were changing and what happened immediately before it, such as an install, update, email attachment, download, browser pop-up, or USB drive.

2. If the prompt was unexpected, isolate the device.
   Turn off Wi-Fi and unplug Ethernet. If you cannot stop repeated prompts, browser lock screens, or remote-control activity any other way, shut the device down and get help before using it again.

3. Check whether the request matches something you started.

   • Windows: If the User Account Control prompt has “Show more details” or similar wording, open it and check the program name, verified publisher, and file location. Be cautious with unknown publishers, misspelled company names, temporary-folder locations, or apps you did not open.
   • Mac: Only enter an administrator name and password if you recognize the app and you intentionally started an action that usually needs admin rights, such as installing software or changing security, privacy, startup, or system settings.

4. If it is a work or school device, stop and use official IT.
   Do not try to bypass the prompt or install a workaround. Contact your helpdesk through a known-good channel, such as the company portal, internal directory, device sticker, or a number you already had saved, and share the screenshot.

5. If it is your personal device, close the suspicious source before approving anything.

   • Close the browser tab, app, installer, file, or settings window that triggered the prompt.
   • If the prompt disappears and does not return, reopen only the setting or app you intentionally meant to use.
   • If the prompt comes back immediately or repeatedly, treat it as suspicious and do not approve it.
   • Remove recent apps, installers, browser extensions, “system cleaners,” or surprise “security scanners” you do not recognize.
   • Use only built-in update tools or official app stores to update your operating system, browser, and security software.
   • Run a full scan with security software you already trust, and follow its recommended actions.

6. Pause sensitive logins on that device until it looks clean.
   Do not log into banking, shopping, email, work systems, or password managers on the affected device while you still suspect compromise. Use a separate trusted device if you need to secure accounts.

7. If you already entered an administrator password or clicked Allow, contain it.

   • Disconnect the affected device from the internet again.
   • If the password was also used for any online account, change those online account passwords from a separate trusted device.
   • Change the affected device’s local administrator password after you have stopped the suspicious activity or received trusted help.
   • Turn on multi-factor authentication for important accounts where available.
   • Run updates and a full security scan before using the device for sensitive activity.

8. If you lost money, shared personal information, or allowed remote access, report and preserve evidence.
   Save screenshots, phone numbers, payment details, emails, download names, remote-access tool names, and any account alerts. If anyone is in immediate danger, call 911. For cyber-enabled fraud or scams, file a report with the FBI’s Internet Crime Complaint Center.