Even if you have no experience in IT, you probably know this best practice: do NOT use an administrator account for everyday computing. But in reality, most people ignore this advice. It makes sense, because most personal computers are configured with admin accounts by default. Also, there’s a perception that using a non-admin account can be pretty annoying over time.
The truth is, separating your daily account from your administrator account is not only a lot more secure, but it’s not much of a hassle at all.
Why running as admin is risky
When you use an admin account all the time, anything that is run while you use your computer has full privileges over your machine. That means any attacks will have maximum impact:
- Malware can silently install itself across the system.
- A phishing attachment can disable your antivirus and change system settings.
- Ransomware can encrypt your entire machine and even others on your network.
However, when you use a standard account, those attacks are a lot more limited:
- Malware has a harder time installing. A UAC prompt will appear if a program tries to do something risky, causing it to fail or giving you a chance to stop it.
- If the Malware succeeds at installation locally, it is stuck at a user level. It can mess with your local files, but not the whole OS.
- Most attacks that assume you’re running as admin, and will often fail outright.
What do I need to do?
- Create a separate local administrator account with a strong password.
- Change your main account (the one you log into every day) to a standard user.
- Use the standard account for everything.
- If prompted for administrator access, double check what you are doing. If everything is working as intended, then type your admin password for installs or system changes.
But I use admin privileges all the time!
Is that really true though? Are you just constantly installing stuff or re-configuring your machine? In reality, most of your daily activity does not need admin privileges. And even if you do need admin privileges, it’s just a simple authentication prompt before you’re allowed to do what you want. It’s really not much of a hassle at all. The process looks like this:
- You log in every day with your standard account.
- If you want to install something or change system settings, Windows asks for your admin password.
- You type it in, done.
That’s really it! If you’re concerned, here’s a truth: even my elderly mother uses her computer this way without any trouble. She logs in normally for email, browsing, and documents, and when she wants to install something, she knows how to type her admin password.
Believe me when I say that if she can do it, anyone can.
Eh, it’s not worth the effort
If you’re technically savvy, it’s true that this might never help you. However, consider some of the biggest malware outbreaks in the last decade. Literally all of these attacks leveraged admin access to maximize damage:
- WannaCry (2017): spread rapidly and encrypted entire disks.
- NotPetya (2017): crippled global companies.
- Ryuk Ransomware (2018–2021): spread laterally by harvesting admin credentials.
Nobody intends to allow attackers into their machine. However, for these major events, users that only utilized standard user access minimized their issues. Minimizing admin access can prevent your world from being turned upside down.
Just do it
Even IT veterans sometimes use admin accounts for daily use because it feels like a hassle to do otherwise. But it really isn’t bad at all! It’s quick, painless, and massively reduces your risk.
Don’t use an admin account for daily use. Keep your admin account locked away for when you need it. For the day to day activities, stick to standard user access. You won’t even notice the difference, and it will save you from disaster.