Do you have both a User account and an Admin account?

I also only use Admin account

If I am logged in as user, I can't access any of admin's files without 'his' password.

FreeBooter said:

You can apply same file permissions to Admin account as you do with standard user account.

Click to expand...

What you want is one account isolated from another to protect data rather than system itself.
The isolated one being the Administrator account because of UAC since granting UAC also gives access to Admin's data.

I have to say that I am lazy and I only have one account. This is probably because I make a lot of changes to my account, initially, and I can't be bothered to work out which I would need to an admin account and which I would need to an ordinary account.

All my machines have a minimum of two accounts, both administrators. On is for general use, the second is a local administrator account, there just as an emergency way into the system should the main account ever become corrupted and/or unusable.

I ticked Other: Back in the day, I used to have one admin account, one work account, and one entertainment account. But since Win 10, I have been using only the one admin account to do all my stuff - I just locate my files and programs on different disks, and I find that more logical. At work, the computers I share have two account (one admin, one standard user), and I have access to both these accounts.

It is not true that logged in with an admin account, with UAC on, you will always see the UAC dialog box when something requires admin rights. There are plenty of bypasses for the consent dialog box (the Yes/No box); see the UACMe project on GitHub. The dialog box requiring credentials has not been bypassed that I know of, so using a user account and putting in an admin password is safer than the Yes/No UAC dialog.

@pseymour
Yeah, aka. privilege escalation, there is plenty of code online to mimic the UAC and steal Admin password.

Only you, the user can help mitigate this.

Either you use admin and user accounts or you only use an admin account! I can't believe anyone would answer 'other' just because they have more than two accounts!

I have 2 accounts, both administrator. If something weird starts happening in mine, the first thing I do is test in the other before I start spinning my wheels trying to fix a Windows issue that doesn't exist.

kelper said:

I have two accounts and only sign in with the admin account when it's really more convenient for what I plan to do.

Click to expand...

This is the way that I work on my work machine.

On my home machine, i just use 1 account and have UAC do it's thing.

If your computer gets infected by malware, does it make a difference if you were logged in as admin, or not? Answers from knowledgable people only, please. I don't know the answer but I don't need speculation

Kelper,

kelper said:

If your computer gets infected by malware, does it make a difference if you were logged in as admin, or not?

Click to expand...

The main consideration is the probability of infection. The UAC level affects that.
Once infected, the malware is limited to those areas of the computer it can access.
- If it infected a Standard user account then it can wreck havoc only in areas accessible by that user.
- If it infected an Admin user account then it can wreck havoc in areas accessible by that user. And an Admin user account can access so much more, including other user accounts.
But some malware claims to be able to self-elevate silently [i.e. no prompt appears].

I looked into malware that preyed on Admin user accounts a few years ago [2017, 2019].
- There was no malware that claimed to be able to silently elevate itself to run Admin processes if your were logged into a Standard user account.
- There was a lot of malware that claimed to be able to silently elevate itself to run Admin processes if your were logged into an Admin user account and your UAC was at the default level [2nd to top].
- There was no malware that could silently elevate itself to run Admin processes if your were logged into an Admin user account and your UAC was at the top level. There was one that claimed to be able to do so but it failed [perhaps a Windows update had got in its way as it was over a year old when I tried it].
I have not attempted to stay current with the topic, I just don't have the time any more.

I keep all my computers' UAC settings at the top level because I habitually log in to Admin user accounts. And I keep the Built-in Admin account disabled on all my computers.


Merry Christmas,
Denis

kelper said:

If your computer gets infected by malware, does it make a difference if you were logged in as admin, or not? Answers from knowledgable people only, please. I don't know the answer but I don't need speculation

Click to expand...

It makes a difference depending on how you use your Administrator account.

First of all, a malware can require elevation or it may not require it, which depends on intentions of malware writer.
A malware that requires elevation will not run unless you grant it trough UAC.
A malware that does not require elevation will run and will have access to current account's data but will not be able to do harm to system.

Now knowing this, if you use Administrator to isolate your personal data like credit card number and similar personal information then if a malware that doesn't require elevation is run within Administrator account it will be able to steal your data.

On another side if it's run within standard user account it won't be able to access Admin's data, (a safe place where you keep your data), instead it will only be able steal data from standard user's account, which you don't care because you don't keep anything valuable in standard account, and in same time it can't affect the system.
Exception to this is UAC mimicking or privilege escalation, an attempt to steal Admin's password or to gain Administrator or system privilege.

Second scenario is where a malware requires elevation, if such malware is run and you grant it UAC then you having Administrator isolated to protect your data does not help neither to protect the isolated data nor does it help to protect the system.
Once a malware that requires elevation is run and allowed trough UAC the system can't be trusted.

What happens if UAC is turned off?

zebal said:

you're browsing the net as Administrator

Click to expand...

Not quite.
All user accounts, including Admin user accounts, log in as Standard user accounts and remain so except for specific processes which have been authorised by an Admin prompt.
So you are not browsing the net as an Admin despite being logged in to an Admin user account unless you are running your browser 'As Admin' [assuming your browser can actually run in an Admin mode].


All the best,
Denis

ShamrockRig said:

What happens if UAC is turned off?

Click to expand...

Then you or anybody gaining access to your computer can run elevated processes without any prompt appearing.


All the best,
Denis

Try3 said:

Then you or anybody gaining access to your computer can run elevated processes without any prompt appearing.


All the best,
Denis

Click to expand...

Thats what i thought, Ive had it off for years due to its pain in the ass asking me if i wanna, If i didn't wanna i wouldn't have told ya to! lol!
Gotcha tho thanks

Try3 said:

Not quite.
All user accounts, including Admin user accounts, log in as Standard user accounts and remain so except for specific processes which have been authorised by an Admin prompt.
So you are not browsing the net as an Admin despite using an Admin user account.


All the best,
Denis

Click to expand...

I know, you're right, my point is if you keep credit card numbers and similar in your web browser in Administrator account and also use same account to browse the net then nothing matters, malware will steal it regardless of UAC setting.

@kelper
There is misunderstanding in this thread.

My point of an Administrator account is not to protect the system from being hacked but to protect personal data from hackers.

If your system is hacked you can always fix the problem by reinstalling the system, changing router password and what not.
However if you data is stolen, stuff like credit card numbers etc. then you're screwed and no system cleanup or reinstalment is going to help.

So the whole purpose of Admin account and security in general is not to defend your system but your data.

The definition of system security is not defense of the system itself only which is irrelevant, but protection of data:

Computer security, cybersecurity, digital security or information technology security (IT security) is the protection of computer systems and networks from attacks by malicious actors that may result in unauthorized information disclosure, theft of, or damage to hardware, software, or data, as well as from the disruption or misdirection of the services they provide

Click to expand...