Why Use a Standard Account Instead of Administrator?

Why ought somebody who has a PC and put's Windows on it, create a standard account and use it for their everyday computing, instead of just using the Administrator's account they created when they installed Windows?


The following page from microsoft.com,
Change a user's account type - Microsoft Windows Help
entitled "Change a user's account type, says:

When you set up Windows, you were required to create a user account. This account is an administrator account that allows you to set up your computer and install any programs that you'd like to use. Once you finish setting up your computer, we recommend that you create a standard account and use it for your everyday computing.

By default programs run with the same privileges and rights as the active user account. This is very convenient for malware if the user is using an admin account as it can do pretty much anything it wants to. If the user is using a limited account that is bad news for malware as it will be under the constraints of the limited account. Much malware will give up. There are always easier targets elsewhere.

UAC provides many of the advantages of using a limited account with less inconvenience. With UAC enabled an admin account has only limited rights unless more is requested. It is a reasonable compromise between convenience and security. Using a limited account for general use is still better for security but depending on how you use the computer this may be quite inconvenient. Most people opt for the default behavior of using UAC.

I would use the Admin account set up when Win7 is installed, with UAC fully enabled. As stated that should be sufficient.

I personally use an administrator account as plenty of software (especially older software!) expect to be running under administrator privileges, however this does come with heightened personal responsibility for maintaining your computer's and other computers' safety.

andrew129260 said:

~~~
For myself: admin with UAC always notify.

So... if you ever visit a reputable website that is infecting visitors in a way that bypasses the UAC, then that infection will have admin rights on your computer.

If you had visited that same website as a standard user, the infection might still bypass UAC, but it would still need to ask for the admin's credentials.

You cannot say or know that you have not been infected.

You can only say that you have never found an infection.

There is a big difference. Sophisticated Spy Tool ?The Mask? Rages Undetected for 7 Years | Threat Level | WIRED


I run this employer supplied laptop via an admin account because that is what my employer wants. That is the only configuration the help desk supports. Like you, I do important stuff via a VM. But hey, how hard could it be to operate as a standard user? I can always promote my account back to admin if I need the company help desk.

I'll be right back - as a standard user