Why Use a Standard Account Instead of Administrator?

[TomBrooklyn]

Why ought somebody who has a PC and put's Windows on it, create a standard account and use it for their everyday computing, instead of just using the Administrator's account they created when they installed Windows?


The following page from microsoft.com,
Change a user's account type - Microsoft Windows Help
entitled "Change a user's account type, says:

When you set up Windows, you were required to create a user account. This account is an administrator account that allows you to set up your computer and install any programs that you'd like to use. Once you finish setting up your computer, we recommend that you create a standard account and use it for your everyday computing.
​

 

[Britton30]

An admin account runs with higher permission levels than a Standard one. If the account in use is Admin level it's easier for malware to infect the PC.

Having said that, I use only one, Admin, account on my machines.

 

[LMiller7]

By default programs run with the same privileges and rights as the active user account. This is very convenient for malware if the user is using an admin account as it can do pretty much anything it wants to. If the user is using a limited account that is bad news for malware as it will be under the constraints of the limited account. Much malware will give up. There are always easier targets elsewhere.

UAC provides many of the advantages of using a limited account with less inconvenience. With UAC enabled an admin account has only limited rights unless more is requested. It is a reasonable compromise between convenience and security. Using a limited account for general use is still better for security but depending on how you use the computer this may be quite inconvenient. Most people opt for the default behavior of using UAC.

 

[gregrocker]

I would use the Admin account set up when Win7 is installed, with UAC fully enabled. As stated that should be sufficient.

 

[King Arthur]

I personally use an administrator account as plenty of software (especially older software!) expect to be running under administrator privileges, however this does come with heightened personal responsibility for maintaining your computer's and other computers' safety.

 

[andrew129260]

For the average customer: I do what Microsoft recommends. I set up their pc with a separate admin account called admin. I create a password for it and give them that password. I then disable the built in admin account. I then create a standard user account for them with uac at the highest setting to always notify. It sounds like a lot of work, but its actually done very quickly. I have them use the standard account and when they need to do something that requires elevation, the uac box pops up asking for the admin password. Since they have to type a password in instead of clicking yes or no, I find it helps them stop and think about what they are about to approve.

Results? I get way less support calls (about malware) and now make it my default strategy.

For myself: admin with UAC always notify.

 

[Computer0304]

For the average customer: I do what Microsoft recommends. I set up their pc with a separate admin account called admin. I create a password for it and give them that password. I then disable the built in admin account. I then create a standard user account for them with uac at the highest setting to always notify. It sounds like a lot of work, but its actually done very quickly. I have them use the standard account and when they need to do something that requires elevation, the uac box pops up asking for the admin password. Since they have to type a password in instead of clicking yes or no, I find it helps them stop and think about what they are about to approve.

Results? I get way less support calls (about malware) and now make it my default strategy.

For myself: admin with UAC always notify.

That's exactly how I have it too.

 

[UsernameIssues]

~~~
For myself: admin with UAC always notify.

So... if you ever visit a reputable website that is infecting visitors in a way that bypasses the UAC, then that infection will have admin rights on your computer.

If you had visited that same website as a standard user, the infection might still bypass UAC, but it would still need to ask for the admin's credentials.

 

[andrew129260]

~~~
For myself: admin with UAC always notify.

So... if you ever visit a reputable website that is infecting visitors in a way that bypasses the UAC, then that infection will have admin rights on your computer.

If you had visited that same website as a standard user, the infection might still bypass UAC, but it would still need to ask for the admin's credentials.

True, But I have not been infected since I have been a computer user, so ether I have been very lucky or very smart.

I don't know which lol. Anyways, I do most critical things in a Linux VM anyway, so it does not matter much. No such thing as 100% security

And do you run as a standard user? I doubt it

 

[UsernameIssues]

You cannot say or know that you have not been infected.

You can only say that you have never found an infection.

There is a big difference. Sophisticated Spy Tool ?The Mask? Rages Undetected for 7 Years | Threat Level | WIRED


I run this employer supplied laptop via an admin account because that is what my employer wants. That is the only configuration the help desk supports. Like you, I do important stuff via a VM. But hey, how hard could it be to operate as a standard user? I can always promote my account back to admin if I need the company help desk.

I'll be right back - as a standard user

 

[UsernameIssues]

I'm back

MozyHome does not like my demotion to a standard user, but I'm going to stay a standard user (for now) and I'll figure MozyHome out later.

 

[andrew129260]

You cannot say or know that you have not been infected.

You can only say that you have never found an infection.

There is a big difference.

That tis true. Although I usually scan with almost every AV known to man, so if an infection is on my machine, its quiet and runs completely silent, does not show in task manager- and is not known by any AV company.---yet

 

[Alejandro85]

Let me ask the opposite question instead: Why use an administrator account 24/7 when a standard one will suffice?

The answer to all this is security. The idea of that recommendation is to reduce the attack surface of an hypothetical infection/virus/attacker/whatever that might strike your computer, as well as badly-behaving programs that might take more concessions than they should.
Standard user accounts only have permissions to modify things that affect that user account only, like all documents, desktop settings, user-specific program settings and so, but nothing beyond that.
Administrator accounts on the other hand have full, unrestricted access to everything in the system. They can modify system-wide settings, install, remove, modify programs, change drivers and global configurations and all files and registry settings on disk.

This recommendation follows the Principle of least privilege, which also recommends that any process should run with the bare minimum set of permissions to accomplish its task, and nothing else, so that programs cannot perform anything that they're not supposed to do (which helps preventing trojans, and limits the damage by viruses and possible vulnerabilities).

I personally use an administrator account as plenty of software (especially older software!) expect to be running under administrator privileges

Often UAC can help with that while remaining as standard, with file/registry virtualization, that relocates writes to system protected areas to user-specific folders. Of course, some programs do legitimately need full admin access.



My personal preference which adopted a few years ago. I use a standard account for everything, and created a second, administrative account for use though UAC elevations for thing that do need more access. For a few internet-facing programs, I use additional dedicated accounts for each one. While this is, in fact, somewhat harder to use it also it's a nice way to get a little more security. I remember once to have detected a virus trying to sneak in because it triggered a sudden UAC elevation request, which possibly would have done its things if I were using the Windows default settings.

 

[UsernameIssues]

Let me ask the opposite question instead: Why use an administrator account 24/7 when a standard one will suffice?
~~~

1) Things that use environmental variables can break.

rd "%userprofile%\AppData\Local\.......

...might require elevated privileges.

Once elevated, %userprofile% operates in the context of whatever admin account was selected.

2) MozyHome does not handle backing up a standard user well.

3) Utilities might need to be setup twice:
e.g. Task Manager runs as the standard user, but once elevated, it operates in the context of whatever admin account was selected during the elevation process. All of the customizations that the standard user setup, must now be repeated for that admin account. If the standard user opts to add a column to one of the tabs, that user must add the column twice: once as a standard user and once as an admin user. The same "set up twice" is true for Process Explorer, Autoruns and a host of other utilities.

4) Running CPUID CPU-Z as admin, going to the tab named About and clicking on a web link, starts the default browser in the context of whatever admin account was selected during the elevation process. In my case, IE was started. IE (of course) did not have the favorites on the favorites bar that I was used to seeing because IE is not using my user profile. If I had done much surfing while in that mode, I would have been at a greater risk than if I had been an admin user:

4a) IE is running at the high integrity level. Drive by infections can have more of a field day than if I were an admin user that launched IE at the medium/low integrity levels. Do you really expect the average user to understand the impact of integrity levels?
4b) IE does not have 64bit tabs - despite EPM being turned on. This lowers security since ASLR cannot make full use of my 8GB of RAM.
4c) not all aspects of Internet Options launches in the correct context - e.g. while IE is running as admin, asking Internet Options to show you the location of Temporary Internet Files folder will take you to the standard user's Temporary Internet Files folder. Not the correct admin folder where temp files are being placed.



5) CCleaner and a few other apps need to be re-installed due to the account demotion.

6) Unlocker and a few other apps cause Window's consent app to create the secure desktop (e.g. darkened desktop) where I would normally be asked to select an admin account and enter admin credentials, but no dialog box is ever presented. This might also be the result of the demotion.

I'm sure that there are other things that my brief time as a standard user did not ferret out.

 

[gregrocker]

I have never installed any other than the Admin-level account issued during OS install since the installed is assumed to be the owner.

I can't remember this ever being a problem except for both my Dad and one friend, because they were being chronically infected, I downgraded them to a Standard account. I considered this more or less silly because they then had to ask themselves if they wanted to give permission to something they were doing and most times just merrily clicked along as far as I could tell. They swore they never got the prompt for something they weren't doing, but who knows?

What finally did work and has kept either from being infected since is adding Malwarebytes Real Time Protection for $29.95 for life in addition to MSE. Neither has been infected again in several years. My friend did call me a year or two ago to ask if he could turn off MBAM to install a player from a sketchy site and I said No. MBAM should change their disable prompt to "I want to infect my computer."

 

[ThrashZone]

My friend did call me a year or two ago to ask if he could turn off MBAM to install a player from a sketchy site and I said No. MBAM should change their disable prompt to "I want to infect my computer."

:roflmao:

I was under the impression Microsoft is referring to the default windows account to stop all prompts for admin permissions,
Either way feel free to use user accounts as you see fit,
I'll do the same,
Best advice is to read carefully install terms
Cheers.

 

[Britton30]

What finally did work and has kept either from being infected since is adding Malwarebytes Real Time Protection for $29.95 for life in addition to MSE. Neither has been infected again in several years. My friend did call me a year or two ago to ask if he could turn off MBAM to install a player from a sketchy site and I said No. MBAM should change their disable prompt to "I want to infect my computer."

LOL, that should be standard issue on all security software.

 

[Computer0304]

My friend did call me a year or two ago to ask if he could turn off MBAM to install a player from a sketchy site and I said No. MBAM should change their disable prompt to "I want to infect my computer."

:roflmao:

I was under the impression Microsoft is referring to the default windows account to stop all prompts for admin permissions,
Either way feel free to use user accounts as you see fit,
I'll do the same,
Best advice is to read carefully install terms
Cheers.