Should I use a standard account for every day and have a separate Admin account?

kelper · Apr 4, 2025

I have two accounts on my laptop, one user and one admin. Each set up as Microsoft accounts with differing email addresses, passwords and fingerprints.

If someone gains access my laptop they can't elevate their privileges without my second fingerprint. Is is worthwhile or do experts recommennd just one account?

pseymour · Apr 4, 2025

It's "settled science" (although I don't like that term) that running with fewer rights is safer than running with more. Anything your account can do, malware running as your account can do. There are things you can do to bump up the safety, like turning UAC up to the top setting, always prompting for credentials and on the secure desktop, etc., but UAC isn't totally foolproof.

But as a practical matter, most home users aren't going to go through the hassle, and the risk of attack is pretty low. Of course, when something bad does happen to you, the fact that it was low-odds isn't really comforting.

For now, I would say it's still better to run with user rights and use admin as needed. I'll change that opinion if and when Administrator Protection makes it into a stable build of Windows.

kelper · Apr 4, 2025

Response 3 was just for pseymour and Edwin butt I guess I was wrong!!

pseymour · Apr 4, 2025

I actually am an "other," in that I elevate my user account to admin, but in effect it's like having two accounts, so I chose that one. But you did guess accurately for me. :)

krism · Apr 4, 2025

response 2 - I only have a local (non-MS) account on this build which is an admin. Never been hacked.

kelper · Apr 4, 2025

krism said:
response 2 - I only have a local (non-MS) account on this build which is an admin. Never been hacked.

That is just anecdotal. I suggest that you would be safer if you had two accounts.

krism · Apr 4, 2025

kelper said:
That is just anecdotal. I suggest that you would be safer if you had two accounts.

There is no question that that statement is correct..................... :)

kelper · Apr 4, 2025

krism said:
There is no question that that statement is correct..................... :)

So is mine.

krism · Apr 4, 2025

that is what I meant - your statement. DUH how could I make that more clear - I quoted your statement and said it was correct.

spapakons · Apr 4, 2025

I understand the use of a standard account for a novice, so he can avoid damaging the computer. However us experts frequently do stuff that needs administrator rights, including using old applications and games, and it is inconvenient to grant access all the time. I have even set the UAC to the minimum (I completely disabled it in Vista and Windows 7). Besides using a standard account for everything feels very limiting and like using Linux. I don't like being restricted or using Linux, yet another reason to get maximum access.

krism · Apr 4, 2025

Yes, I always set UAC to off very early on in any build. I take frequent images.

spapakons · Apr 4, 2025

For the time being nobody else is using my PC, not even my wife. My son uses it in my presence, once he gets a little older I will create a separate standard account, probably with parental control. Alternatively I may clean install Windows on an old laptop and give it to him. If he damages it, my PC will be safe.

PS: I don't think having two accounts makes any difference than having an administrator account and UAC enabled. Either way you will be asked to grant access when needed, so what's the point of using a standard account in the first place? Unless the standard account is used by a different person, not you. Unfortunately malware will manage to elevate and gain access. The standard account simplify delays it.

kelper · Apr 4, 2025

I do think teenage children can be a security risk as they like to challenge any rules. Thankfully, I have no offspring. It is a sad fact that some children will defraud their parents.

spapakons · Apr 4, 2025

Therefore I will do plan B, give him his own unrestricted laptop and avoid using my PC.

kelper · Apr 4, 2025

If I had children, I would lock the router away so they could not factory reset it! I would set time limits on their access too.

spapakons · Apr 4, 2025

You got it too far... My concern is not to damage my PC. If I set parental control in his laptop I can time limit it.

pseymour · Apr 4, 2025

spapakons said:
PS: I don't think having two accounts makes any difference than having an administrator account and UAC enabled. Either way you will be asked to grant access when needed, so what's the point of using a standard account in the first place?

The difference is the separation provided by the second account. You would have to provide the credentials of the admin account, versus clicking Yes on the UAC dialog box, a dialog box that is easily bypassed by the way. Even if you have UAC set to prompt for creds, the fact that the admin account is not logged in provides a benefit of not having its tokens in memory to be stolen by mimikatz,
for example.

Separate accounts is not the same as UAC. That’s what the forthcoming Admin Protection is about. MS has famously declared UAC is not a security boundary.

AndreyT · Apr 4, 2025

It is not clear, whether this was intended to be a question or a poll...

The question part is slam-dunk: yes, you should user (sic!) a regular user account for normal everyday use of the computer and have a separate admin account dedicated to admin tasks. Having separate accounts is just baseline, of course. On top of that baseline, one would normally use `runas` to gain temporary admin access from under regular user account - to perform "quick touch-up" kind of administrative tasks without having to switch accounts.

As for the poll... not sure of its purpose, considering how old and beaten-to-death the topic is.

pseymour · Apr 4, 2025

Maybe kelper wants a current snapshot of what people are doing. Or maybe he missed the earlier discussions. We don’t need the impetus for the poll; just answer it or move on with life.

spapakons · Apr 4, 2025

Imagine a DNA check surface that you would have to submit a blood sample to gain access. Like when self checking the blood sugar... Bah... fingerprint sensor should be sufficient. Are there independent USB models or you can find one only embedded on a laptop?

Should I use a standard account for every day and have a separate Admin account?

Do you use an admin and a standard account?

Yes, I have both

No, I only have an admin account

Other, because there's always one!

Well-known member

My Computers

proficient sock drawer organizer

My Computers

Well-known member

My Computers

proficient sock drawer organizer

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

proficient sock drawer organizer

My Computers

Member

My Computer

proficient sock drawer organizer

My Computers

Well-known member

My Computers

Similar threads