What to do if…
your device suddenly prompts for administrator permission for normal settings changes
Short answer
Don’t approve the prompt yet. Pause, disconnect the device from the internet if anything feels off, and verify exactly what is requesting admin access before you type any password.
Do not do these things
- Don’t enter an administrator password just to “make it go away” if you’re not sure which app/process is asking.
- Don’t click “Allow/Yes” if the prompt doesn’t clearly name a trusted system component or app you intentionally opened.
- Don’t call any phone number shown in a pop-up, and don’t install “support” tools suggested by a prompt.
- Don’t hand over remote access (screen sharing/remote control) to anyone who contacted you because of the prompt.
- Don’t weaken security protections “to get past this” (for example, disabling Windows UAC). Only change security settings if you’re sure the request is legitimate and you initiated it (or your IT team advises).
What to do now
-
Stop and capture what you’re seeing.
Take a screenshot/photo of the prompt (including the app name/publisher if shown). Write down what you were trying to change and what happened immediately before the prompt appeared (new install, update, email attachment, USB device, browser pop-up). -
If you did not expect this prompt, disconnect from the internet briefly.
Turn off Wi-Fi and unplug Ethernet. This reduces the chance of anything communicating out while you check what’s happening. -
Check whether it looks like a normal system prompt (without approving it).
- Windows: If there’s a “More details/Show details” option, open it and look for the program name and publisher. Be extra cautious if the publisher is unknown/unverified or the name/location looks unfamiliar.
- Mac: Only enter an admin name/password if you recognise the app requesting it and you intentionally started something that normally needs it (installing software, changing security/privacy settings).
-
If it’s a work/school device, assume it’s managed.
If you don’t normally have admin rights, stop and contact your IT/helpdesk using a known internal method (company portal, intranet, sticker on the device, or a number you already have saved). Share the screenshot and say: “I’m getting unexpected administrator permission prompts for normal settings changes.” -
If it’s your personal device, do a quick “safe checks” pass before approving anything.
- Close the app you were using. If the prompt returns immediately or repeatedly, treat that as a warning sign.
- Check recent installs and remove anything you don’t recognise (especially “cleaners”, “security tools”, and browser extensions).
- Update your operating system and browser.
- Update your antivirus/anti-malware, then run a full scan and follow its guidance.
-
If you think a message/link triggered it, report and delete it.
- If it came from an email: forward it to report@phishing.gov.uk (don’t click links).
- If it came from a text: forward it to 7726 (don’t reply to the sender).
Then delete the message. Keep your screenshot/notes.
-
If you already typed your admin password or clicked Allow:
- Disconnect from the internet again.
- From a different, trusted device, change the password for the account you entered (and any important accounts that reuse it), and turn on two-factor authentication where available.
- Then do the update + full scan steps above.
-
If money was demanded, details were stolen, or remote access happened:
Report it via Report Fraud (the UK’s reporting service for fraud and cyber crime).- If you live in England, Wales or Northern Ireland, use Report Fraud’s online reporting tool.
- If you live in Scotland, contact Police Scotland on 101 (or 999 if there is immediate danger).
Save any screenshots, payment references, phone numbers, and emails for your report.
What can wait
- You don’t need to diagnose the exact cause right now.
- You don’t need to reinstall your whole device immediately unless scans/IT tell you it’s necessary.
- You don’t need to decide today whether to make a formal report unless you’ve lost money or sensitive personal data—just preserve the basics (screenshots, notes).
Important reassurance
Unexpected admin prompts are common during legitimate updates and settings changes—but it’s also a common way scams and malware try to get control. Pausing before you approve anything is the safest default, even if it turns out to be harmless.
Scope note
This is first steps only to reduce harm and buy time. If prompts keep happening or you can’t confirm what’s requesting access, you may need IT support or professional malware help.
Important note
This guide is general information, not device-specific repair or professional security advice. If you feel unsure at any point, stop and get help (especially for work/school devices), because approving the wrong admin prompt can grant full control to malicious software.
Additional Resources
- https://www.gov.uk/report-suspicious-emails-websites-phishing
- https://www.reportfraud.police.uk/
- https://www.reportfraud.police.uk/reporting-a-fraud/
- https://www.ncsc.gov.uk/guidance/hacked-device-action-to-take
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works
- https://support.apple.com/en-gb/guide/mac-help/mhosxlogo1438/mac