Why You Shouldn’t Use an Admin Account as Your Main Account

Just about everyone uses an administrator account for the primary computer account. But there are security risks associated with that. If a malicious program or attackers are able to get control of your user account, they can do a lot more damage with an administrator account than with a standard account. You can protect yourself by using a standard account as your primary account and then temporarily elevating permissions when you need to make administrator changes.

What’s the difference between admin accounts and standard accounts?

Administrator accounts (or admin accounts) are basically the most powerful account type on a computer. They have permission to do just about everything on a machine – think of the I.T. guys at the office that you have to ask before certain operations. Every computer needs to have at least one admin user somewhere.

Standard accounts are more limited. The ways in which they are limited can vary depending on operating system and OS type. Typically, standard accounts can’t install new software or access critical system files. They can access user files and do most day-to-day work, but as a rule, standard accounts are prohibited from making serious or permanent changes to the computer.

Non-admin accounts can be locked down in a variety of ways. With user controls, administrators can place much more severe restrictions on user accounts. This runs the gamut from prohibiting certain applications and URLs to setting a daily time limit.

Why are standard accounts more secure than admin accounts?

Admin accounts have absolute permission to do pretty much whatever they want with a machine. And as the owner or primary user of a hardware device, it might make sense to use an admin account as your main account. But this has some security risks associated with it. If malware is installed under your user account, the malware can do anything that you can do. So the more permissions your user account has, the greater damage the user account can do.

Standard accounts don’t have as much flexibility. Malware installed under a standard account can’t make any damaging changes to system files. And attackers that gain access to a standard account can only access that user’s files. As a result, the restrictions of standard accounts work in your favor should an adversary or malicious program gain access to your account.

Creating standard accounts

If you want to try out using standard accounts, it’s pretty easy. If you’re dealing with a personal machine, you’ll first want to create a new administrator account. Your computer needs at least one administrator to make system changes. Then, you’ll want to change your primary user account to a standard user account. If you already have a secondary administrator account for some reason, you can skip creating the new account.

Windows

1. Open the “Settings” app.

2. Click on the “Accounts” icon.

3. Choose “Family & other people” from the sidebar.

4. Click “Add someone else to this PC” under “Other people.”

5. Click “I don’t have this person’s sign-in information” and then “Add a user without a Microsoft account” to skip the Microsoft account search. You can add this later. Windows Home users may not see this step.

6. Enter the username, password and password hint for your new administrator account. Click “Next” to complete the account creation.

7. Click on the account name and click the “Change account type” button.

8. Chose “Administrator” from the dropdown menu. You may need to restart your computer for this change to take full effect.

9. Log into your new administrator account.

10. Navigate to the “Family & other people” pane again. Click on your user account and change the account type to “Standard User.”

11. When you see a UAC prompt, enter the username and password of your new administrator account’s credentials to proceed.

macOS

1. Open System Preferences.

2. Choose “Users & Groups” from the bottom row.

3. Click the lock and enter your password to unlock the pane.

4. Click the “+” button to create a new account.

5. Choose “Administrator” from the “New Account” dropdown menu.

6. Set the username and password as you like. Make sure “Allow user to administer this computer” is checked at the bottom.

7. Log out of your current user, then log into your new user.

8. Select your previous account in the sidebar, and uncheck the box that says “Allow user to administer this computer” to convert your admin user to a standard user.

9. When prompted, restart your computer to downgrade your account.

10. Log back into your user account and use it as normal. Enter your new admin user’s username and password when you need to perform administrator tasks.

Conclusion

While using a standard user account might be slightly more annoying, it does provide security benefits that can protect you in the event of a security failure.

Image credit: Designed by Freepik