Windows 10: Windows accounts - advice using admin + standard user on W11

I have always used two accounts for personal computers using Windows since XP days, an admin account plus a standard user account and I always advise friends and family to do the same. I am very disappointed that computer manufacturers do not even suggest this for new computers otherwise, in my opinion as a professional Windows user since the beta version of Windows 1 - now retired, leaving the new user with just the initial account which has to be an admin account is very dangerous. I hope that your experts here agree with me! With at least 20-30 systems that have been set up following my

:)

 

admin & standard user accounts

Hi Pub Fan,

You can create a new user account on your computer and set is as an administrator. Follow the steps provided on this

page. Once you have added a new administrator account, you can change the account type of the original user profile to standard. You can also remove the password for the original account using the new one. Here are the steps:

• Sign in to the new user account.
• Go to Control Panel.
• Open User Accounts.
• Click on User Accounts.
• Click on Manage another account.
• Select the old user profile.
• Select Change the password.
• Without typing anything in the password fields, click on Change password.

You will not lose any passwords for your internet sites after applying the changes.

Let us know if you need more help.

 

Unable to perform admin tasks after converting Admin account to Standard user

Hi,



Thank you for writing to Microsoft Community Forums.



We understand that after making your Admin account as a Standard user account, you are unable to perform any task that requires admin access. We would like to inform you that if we make an Admin account as a Standard account, we would not be able to
perform Admin tasks, to do so we will need permission from the Admin account.



As you have mentioned that, you have another Admin account on the computer, we can use the other account to change the account type of your account. Refer the steps mentioned below:

1. Login to the computer using the second account.
   
2. Press Windows key + R, to open
   Run dialog box.
   
3. Type netplwiz and click on
   OK.
   
4. Now, double click on your user account and click on
   Group Membership tab.
   
5. Select Administrator and click on
   OK (Twice).
   

Let us know the results.



Regards,

Nikhar Khare

Microsoft Community - Moderator

 

There is no greater risk of malware infection for an Admin user account than there is for a Standard user account

Technical Level : Intermediate

Summary
My aim is to answer this question - Is it always correct to advise computer owners to log in for day-to-day computer activities as Standard users rather than as Admin users as a system security measure?

This article is an extract from a longer report that was originally posted in a thread in this forum in 2013. The report has been reviewed [17 May 2015] and is available
in
pdf format.

The operating system considered during the investigation was Windows 7.

Windows 10 users cannot assume that the same considerations apply. There are some differences in the behaviour of the Built-In Admin account in Windows 10 so there might well be other changes affecting the current topic [in Windows
10, the Built-In Admin is designed not to be able to access Settings].

Details

1. There is no greater risk of malware infection for an Admin user account than there is for a Standard user account.
   
2. There would be, in principle, no difference in the amount of system damage caused by a malware infection in an Admin user account than there would be if a Standard user account were infected.

A computer owner can decide whether or not to log in as an Admin user based merely on convenience as long as these conditions are met:

1. UAC is at its default setting, and
   
2. All UAC prompts are studied so that unthinking approval is not given, and
   
3. IE’s Protected Mode & SmartScreen Filter are on, and
   
4. Data Execution Prevention (DEP) is on, and
   
5. A real-time anti-malware utility is on, and
   
6. The Built-In Admin account is disabled, and
   
7. The Guest account is disabled.
   

There is a fairly common misconception
that an Admin user account is more prone to getting infected. This is not true.

There is a fairly common misconception
that an Admin user account [other than the Built-In Administrator account] has system-wide access. This is not true.

The most that can be said for always logging in as a Standard user is that

1. Doing so enforces the need for a password in the UAC prompt ["Elevation UI”] so, it might be asserted, the user is more likely to pay attention to what the
   Elevation UI is seeking approval for than if it merely requires a click on the OK button [as is the case when logged in as an Admin user].
   However, I found no evidence to justify such an assertion despite exhaustive searches.
2. Any malware infection is limited to those folders in which the infected account can make changes [write new files, edit existing files, delete files]. Whilst this applies equally to Admin user accounts, it is likely that over time many of the
   folders of other users will have granted write access to an Admin user account -
   this often happens because the Admin account is used to sort out problems being experienced by other users. Such access means that an infected Admin user account can spread malware across to the folders of other user accounts and so there would be
   more of the computer to clean up after an infection. This, for me personally, is persuasive and is the reason that I only use an Admin user account when it is unavoidable.
   

- - - - - - - - - - - - - - - - -

I am not questioning the usefulness of having two additional password-protected Admin accounts i.e. in addition to those accounts routinely logged in to by users.
The existence of & limited usage of these accounts enhances system resilience by establishing a high degree of confidence that at least one fully-functioning
& malware-free Admin account will exist when other accounts are afflicted with user profile corruption or malware.

1. One of these additional Admin accounts can be used for granting Admin approval in UAC prompts and for other tasks that demand an Admin account [such as making System images or obtaining device drivers from the
   Microsoft update catalog service].
   
2. The other additional Admin account is held
   in reserve, tested but otherwise unused.