Is It Best Not To Use PC As Admin User Now Win7 Not Supported by MS?

[woodbine]

I read an article the other day about the demise of Win7. They recommended that if still using Win7, you shouldn't be logged on as an administrator user. They said that this was basically handing the keys to anyone who attacked your pc now that MS aren't doing security updates/patches. The article said that Win7 users should be logged on as ordinary users, and only log on as an admin for as little time as possible to carry out tasks that need this.


Is this good advice, or are they worrying unnecessarily?

 

[NoN]

Would be nice to have the link of the article you readed...thanks

 

[Barman58]

It's always been good advice I used to follow this system for many years when running Large IT systems, Microsoft however has made things slightly easier for us since Vista .

If you make sure to set set up your user as a regular admin, with a password, ( the first user that is created when you install windows is set up this way), and you make sure that UAC is set to the second from the top, you will actually run as a standard user and will be asked for your password if you try to do something that needs more rights than a standard user. If you are the only admin on the system it will usually only ask for confirmation, after a few password entries.

If a non admin tries to access something that is admin required, the screen locks and requires the full password entry at the connected keyboard, which is very difficult to impossible to do in software

The reason for this security method is that any malware, (virus Etc), takes the powers of the user it infects, so if you run as an admin it can do more damage than it can if it infects the standard user this system runs at

 

[woodbine]

Would be nice to have the link of the article you readed...thanks

Sorry, I tried to find it, but it's well hidden somewhere out there on the web.

 

[woodbine]

It's always been good advice I used to follow this system for many years when running Large IT systems, Microsoft however has made things slightly easier for us since Vista .

If you make sure to set set up your user as a regular admin, with a password, ( the first user that is created when you install windows is set up this way), and you make sure that UAC is set to the second from the top, you will actually run as a standard user and will be asked for your password if you try to do something that needs more rights than a standard user. If you are the only admin on the system it will usually only ask for confirmation, after a few password entries.

If a non admin tries to access something that is admin required, the screen locks and requires the full password entry at the connected keyboard, which is very difficult to impossible to do in software

The reason for this security method is that any malware, (virus Etc), takes the powers of the user it infects, so if you run as an admin it can do more damage than it can if it infects the standard user this system runs at

Thanks for your reply, Barman.


I'm the only user on my pc, and obviously set to admin. What should I do to make things more secure? Change my user account to standard user? Then set up another user account as admin?

 

[Barman58]

If it's the first account that you created when you installed Windows (or when the builder did this), it should already be set as a Dual Admin/Standard user

You just need to open settings and type "UAC" into the search bar that will show the User Account control menu - I always advise to set this to one below the top setting which gives a good prompt setting level, you will not be prompted for most admin tasks but will for the most "dangerous" which is what a Virus etc wants access to.

It's possible to set it lower than this but the danger to your data increases with each selection

 

[Bree]

I'm the only user on my pc, and obviously set to admin. What should I do to make things more secure? Change my user account to standard user? Then set up another user account as admin?

The other way round. You must set up another account as an administrator first!


If you demote your only administrator account to a standard user you'll not be able to set up any more accounts (or do anything else that needs admin privileges).

 

[woodbine]

You just need to open settings and type "UAC" into the search bar

Thanks Barman. Which settings are those and where do I find them? Control panel?

 

[woodbine]

The other way round. You must set up another account as an administrator first!


If you demote your only administrator account to a standard user you'll not be able to set up any more accounts (or do anything else that needs admin privileges).

Good advice, Bree. Will do it that way.

 

[Barman58]

Thanks Barman. Which settings are those and where do I find them? Control panel?

Yes, open control panel type UAC into the search box, it should come back with a link to the settings and also a link to the help page for how and what to see, which is good to read before you choose an option

 

[woodbine]

Yes, open control panel type UAC into the search box, it should come back with a link to the settings and also a link to the help page for how and what to see, which is good to read before you choose an option

I had a look at UAC on control panel and the setting is next one down from 'always notify'.


Yes, my user account is the only one that's ever been on this computer from new. I had a look and can't tell if it is dual admin/standard from the screen shot below. Looks like only admin.

 

[Barman58]

It looks like all the settings are correct so you have a secure setup already - you should see a prompt occasionally when you are setting the more security based settings - so you already are running a more convenient version of the Admin / Standard user system that was recommended in the article you read, and, unlike many, actually acted upon

 

[woodbine]

Thanks Barman, that's good news.

So the boxes that appear saying "do you want to allow XXXXXXX to make changes to your computer?" when I do something like add a new programme - are the boxes that will protect my pc if anything tries to attack it? And because these boxes appear to ask my permission, I have the correct settings?

 

[Barman58]

Yes, you should see less of them as time goes by and the system learns your usage patterns, when the box is on screen the only thing allowed is to type the password locally on the system, so a virus or other malware could not do this.

also if you see something trigger a box asking for permission, when you are doing something else, you can check out the details and either accept or deny access, deny is usually the safest until you check on what the triggering app is trying to do.

Often installing an app will add other "supposedly helpful" apps without informing you - if these are deemed dangerous the popup gives you control

 

[woodbine]

Thanks. The box that appears never asks for my password. I can't ever remember having to use a password on this pc. The box just asks if I want to allow changes to my computer or not.

 

[Barman58]

The system is set up to ask you when you open an application that has Potential to make a change to system items, thinking behind this is that if the application cannot do any damage then it's fine not to ask you.

The problem that we have is that malware impersonates the user on the system, if all this user can do is things like create a folder or change the colour of the background there is no danger to the system, if however you are an administrator you and therefore malware impersonating you can do serious damage or add malicious programs,

The special screen and the password requirement which has to be entered on the keyboard attached to the system and is the only thing allowed to be done, stops the malware from taking control.

I spent many years years running networked systems in industry , and using the dual user technique. I will say that I did run as admin at times, for longer than would be safe today, but of course there were not the threats that we have now, the main reason for not running as an admin all the time, was you could leave your desk and not be concerned with another user using the system and doing damage

 

[Barman58]

If a standard user account tries to open an application, or if a non logged in user does so, it will prompt for the password. If the current logged in admin user attempts to access something potentially dangerous it will just ask for confirmation.
The frequency of the prompt and how often the password is needed is dependent on the level set on the UAC settings. The lower down the list UAC is set the less prompts you will see, but the less secure the system will be. The second from the top has been found the best balance for normal home use, the top level is better in a secure environment some home users set to third level and thus see fewer prompts..

UAC can be switched off but you then return to the base security levels of XP which was designed before the explosion of malware we have today, and as the OS is designed around the UAC, switching it off can cause odd behaviour so Microsoft advises against this