Solved Can I convert my administrators account to standard user?

Hello


I have my system all setup the way I like it. All security software etc... setup. I assume it would be a good idea to change the account to standard user for some extra security. So, should I simply create a new admin account then change my current admin over to standard user? Will I encounter any problems using software after the change? If I do have issues can I solve them by switching he account back to admin level? Thanks for your help

Before you change your current admin account over to standard. Just a little tip disable UAC.

Start > Control Panel > User Accounts > Change User Account Control Settings > Set the toggle to the bottom one.

Just incase you've installed programs that still require a security warning.

RoloDman said:

Hello


I have my system all setup the way I like it. All security software etc... setup. I assume it would be a good idea to change the account to standard user for some extra security. So, should I simply create a new admin account then change my current admin over to standard user? Will I encounter any problems using software after the change? If I do have issues can I solve them by switching he account back to admin level? Thanks for your help

Click to expand...

> So, should I simply create a new admin account then change my current admin over to standard user?
That is a good way to do what you are wanting to do. You don't even need to log onto the new admin account - so no profile is created unless it is needed at some point in the future.

> Will I encounter any problems using software after the change?
You should not - but you might.

> If I do have issues can I solve them by switching [t]he account back to admin level?
Yes.

CBlunt said:

Before you change your current admin account over to standard. Just a little tip disable UAC.

Start > Control Panel > User Accounts > Change User Account Control Settings > Set the toggle to the bottom one.

Just in case you've installed programs that still require a security warning.

Click to expand...

Could you please explain that last sentence?
I'm unclear as to when this would be an issue.

@CBlunt,
If you want to be put to sleep...
...then work your way through this long/boring post of mine:
http://www.sevenforums.com/system-security/308472-mse-worries-9.html#post2584410

thanks, UsernameIssues, all is well thus far

Yes, I created my main username account as admininstrator when installing Windows, windows updates, all software etc, then created a new Admininstrator account and changed my main account to standard. It seems about 99% of software updates (not just MS) only require me to type in the Admin password from my standard username account when modifying or updating programs.

Occasionally if that doesn't work and I need to configure certain software that the username account uses from within the username account, I simply set it temporarily to adminsitrator privileges, log out and then log back in again, do the tweak then change back to standard user.

Just in case, all my data files sit on a separate harddrive, and I set my libraries to that so there is no user data on the main harddrive in any username account. I can thus read my datafiles from either account (though an administrator account would also let me do that).

I think the only restriction is in naming the account - I don't think it would let me call the new account Administrator so I called it Admin (or other way round I forget which).

Never had a virus or other nasty attack my system since setting it up that way.

Diddlededum said:

... I don't think it would let me call the new account Administrator...

Click to expand...

...because there is already a hidden/disabled account by that name:
http://www.sevenforums.com/tutorials/507-built-administrator-account-enable-disable.html

Doing so is in fact a very good idea, it makes things harder to break and limits your own permissions to just those you really need, security-wise is a very good move.
My personal preference is to create 2 accounts as you propose, one being admin and the other don't, using the normal one for everything and the other just for UAC elevation when it becomes necessary to access system-level settings (and also tweaked the UAC prompt to make it harder to elevate, just to make things a bit safer).
As for software having problems, most should run OK I think. A few programs, specially some older or badly designed, might have certain problems with insufficient permissions or problems managing their data files. I would NOT revert to admin just for that. Try always to find the root cause of the failure, and attack that instead. Maybe the program has a legit reason to be run as administrator, so you should use UAC to elevate it, or maybe it's simply flawed and want to save settings in system areas, so virtualization should help here.

CBlunt said:

Just a little tip disable UAC

Click to expand...

Is there any particular reason to give this advice? In fact, it really helps with security. The elevation prompts provide an easy way to get admin access on ONE program, instead of the whole shell. UIPI helps preventing non-elevated programs tampering with the elevated ones, and also allows to use low-integrity programs that have even fewer permissions than the user for particularly dangerous operations. File virtualization makes possible to run some older or flawed programs that write to system-protected locations that normally would have yielded an access denied error.
Disable UAC and you lose all those. Is there any gain?

As a comment, it's normally better to raise the level to the maximum, as the default level introduced in Windows 7 is buggy and can be bypassed at will.

UsernameIssues said:

Diddlededum said:

... I don't think it would let me call the new account Administrator...

Click to expand...

...because there is already a hidden/disabled account by that name:
http://www.sevenforums.com/tutorials/507-built-administrator-account-enable-disable.html

Click to expand...

Better to use a different name, "Adminitrator" is normally related to the built-in account. But if you REALLY want to name it so, it's possible to rename the built-in one though local policy editor, then create a new one called administrator.