Authorized Personnel Only: Use Non-Admin Account

Every new computer comes with one account, and most people never change that – but we all should. The default account on your computer is an administrator or “admin” account. This account has full permissions to do anything – which is convenient, but dangerous for daily use. One of the first things you should do with any new computer is to create a second account that does not have full admin privileges – a non-admin account – and you should use that account almost exclusively. Why? Because anything you can do – anything you can change, install, uninstall, configure, etc – malware on your account can also do. This is the Principle of Least Privilege: you only give someone as much access as they absolutely need. For day-to-day computer use (checking email, surfing the web, running applications) you don’t need full admin privileges.

The Proof is in the Pudding

How important is this? A recent study by Avecto claims that 80% of the critical vulnerabilities found on Windows in 2017 could have been mitigated by using a non-admin account. That same study said that a whopping 96% of Edge vulnerabilities would have been mitigated. (Edge is Microsoft’s new web browser.)

Similar results were seen in a previous study for 2015. That study found that 85% of critical Windows vulnerabilities and nearly 100% of Internet Explorer bugs would have been mitigated with this technique.

Minimum of Two Accounts

If you’re the only person using a computer, that would mean you need at least two accounts: one admin account that you rarely use and one non-admin account that is used most of the time.

But there are many great reasons for having more accounts:

• Every person that uses the computer should have their own account. This is not just for security compartmentalization, but also to allow each person to have their own space. They can customize all the settings – background image, quick-launch apps, docks on the desktop, etc. But it’s also healthy for everyone to have a little personal privacy.
• Having separate accounts for kids is pretty much mandatory. You never know what they might mess up, so it’s good to have them contained. It also allows you to use parental controls to limit what apps they can run and what web sites they can visit. You can even limit their screen time per day.
• You might also consider having a guest account, if you frequently have people over. This is an account for checking email and surfing the web.

The More the Merrier

You might even want to have more than one account per person:

• You could have a “financial” account, where you access your banking and investment websites, host your financial records files, file your taxes, etc. This protects this sensitive data from attackers, if they were to somehow compromise your daily use account.
• You could have a “presentation” account on your work laptop, without all your personal stuff that might be private or even embarrassing. This account would not have social media or messaging apps running where you might get notifications pop-ups. It could have your company logo as the background image instead of a family photo.
• You might have a “gaming” account that’s tuned specifically for performance. There would be no other apps running and maybe the computer settings would be optimized for your gaming experience.

Creating a Non-Admin Account

Since the account you have is probably already an admin account and you probably want to preserve this for day-to-day use, this is what I suggest:

• First create a new account and make that your admin account. Call it “admin” or something obvious. Give that account a strong password that you will remember. Do NOT choose something easy to guess! This should be a very spartan account. You won’t use it very often.
• Log into your new admin account, and downgrade your old/original account. Make it a non-admin account. This will preserve all the things you’ve already set up there, it will just lower your privileges.

When you’re on your regular account and something you do requires admin privileges, it will pop up a dialog and ask for your admin account credentials. Just be wary when some application you just downloaded asks for this… make sure it’s not malware and that it really needs admin access! That’s the whole point of this exercise – to insert this permission step.

Obviously, any other accounts you set up on this computer should also be non-admin accounts. You only need one admin account. Just be sure you keep that password somewhere safe (like a password manager).

For step-by-step help on setting up these accounts, you can read my book (Tip #22) or click one of these links: Windows / Mac.