How many of you are running as Admin account on your personal computer?

pseymour · Friday at 2:20 PM

I am convinced by your sample size of one.

Steve C · 2026-08-29T02:51:02-0400

win11freak said:
Just curious, for the security gurus here that are very cautious on they do on their own personal machine, are you still running as a Standard Local Account?

On all PCs I use a standrd account for daily use and only use the admin account for PC maintenance. Both are MS accounts.

Steve C · 2026-08-29T02:53:46-0400

Marie SWE said:
Question:

For real high security i would not even use Windows.....
Reason...... Windows have to big market-share and therefore is the biggest target out there..... and there is literally millions of black/gray-hat hackers and crackers and even state-sponsored ones that spend all days just to find new ways to infect or to exploit windows machines.

Always local account as online account require you to always have internet.. that is bad.. you need to be able to work totally offline.

As i do need windows for banking and some other things that is really sensitive..... Here is what i have right now as a secure windows solution.

First i have Linux installed as a host-OS.... On that install i have a firewall with block all traffic as default and ask for permission.. both inbound and outbound traffic.
... The outgoing traffic is as important to control as the incoming.. windows and most firewalls have Block all incoming and allow ALL outgoing traffic.
This is bad.. as if you get a spyware or a malware that makes a tunnel connection outgoing for the attacker to abuse..... the firewall rule with "allow all outgoing traffic" will just let it happen.
I also have real-time network monitoring, so if i start to see traffic going to another country, then something is wrong.
Then i have Windows installed as a VM.. i installed everything and tweaked it offline. Then after i was finished with all installs etc. etc. i made a clone of that VM.
I only using the clone.. never the original one... This way i have an more or less an Immutable windows version that i just delete now and then and make a new clone of the original to use again.

But if i couldn't cheat like that and had to use a bare-metal install.
I would set up the install and make all hardening tweaks etc. add a firewall that actually control outbound traffic as well with block all as default and ask for permission. add software i need.. and then create a user account with no admin rights to use.
Then i would do an disk-to-image clone of the setup...... And..... on the first tiny sign, or with just a bad feeling, or just a bad dream while sleeping.. i would wipe the disk and restore the disk clone.

As it just takes minutes or say half an hour to an hour on a slower system.. why even take a chance of not wiping the system if you get a bad feeling.

Not true, you can login not connected to the internet even if using an MS account.

spapakons · 2026-08-29T05:51:02-0400

Fearing of using an admin account means you don't trust yourself. For everyone else using the computer, I agree with having his/her separate standard user account. I wouldn't trust anyone else with an admin account even if I was watching what they were doing above their shoulders.

TairikuOkami · 2026-08-29T05:56:46-0400

For years I used system admin, but I use admin with full UAC now, that will do. MSA provides a perfect protection from remote attacks.

Code:

rem =================================== Windows Policies ===================================
rem --------------------------------- User Account Control ---------------------------------

rem https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd835564(v=ws.10)
rem Reason to set UAC to Always Notify - https://learn.microsoft.com/en-us/previous-versions/technet-magazine/dd822916(v=msdn.10)
rem https://daniels-it-blog.blogspot.com/2020/07/uac-bypass-via-dll-hijacking-and-mock.html
rem https://www.bleepingcomputer.com/news/security/bypassing-windows-10-uac-with-mock-folders-and-dll-hijacking/
rem There are really only two effectively distinct settings for the UAC slider - https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105

rem 0 - Elevate without prompting / 1 - Prompt for credentials on the secure desktop / 2 - Prompt for consent on the secure desktop / 3 - Prompt for credentials / 4 - Prompt for consent / 5 (Default) - Prompt for consent for non-Windows binaries
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "1" /f

rem 0 - Automatically deny elevation requests / 1 - Prompt for credentials on the secure desktop / 3 (Default) - Prompt for credentials
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorUser" /t REG_DWORD /d "0" /f

rem 2 (Default)
rem reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableFullTrustStartupTasks" /t REG_DWORD /d "0" /f

rem Detect application installations and prompt for elevation / 1 - Enabled (default for home) / 0 - Disabled (default for enterprise)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableInstallerDetection" /t REG_DWORD /d "1" /f

rem Run all administrators in Admin Approval Mode / 0 - Disabled (UAC) / 1 - Enabled (UAC)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "1" /f

rem Only elevate UIAccess applications that are installed in secure locations / 0 - Disabled / 1 (Default) - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableSecureUIAPaths" /t REG_DWORD /d "1" /f

rem 0 (Default) = Disabled / 1 - Enabled
rem reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableUwpStartupTasks" /t REG_DWORD /d "0" /f

rem Allow UIAccess applications to prompt for elevation without using the secure desktop / 0 (Default) = Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableUIADesktopToggle" /t REG_DWORD /d "0" /f

rem https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/932a34b5-48e7-44c0-b6d2-a57aadef1799
rem 0 - Disabled / 1 - Enabled (Default)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableVirtualization" /t REG_DWORD /d "0" /f

rem Admin Approval Mode for the built-in Administrator account / 0 (Default) - Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "FilterAdministratorToken" /t REG_DWORD /d "1" /f

rem Allow UIAccess applications to prompt for elevation without using the secure desktop / 0 (Default) - Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "1" /f

rem Administrator Protection for Admin Approval Mode / 1 - Disable / 2 - Enable
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "TypeOfAdminApprovalMode" /t REG_DWORD /d "1" /f

rem Enforce cryptographic signatures on any interactive application that requests elevation of privilege / 0 (Default) - Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ValidateAdminCodeSignatures" /t REG_DWORD /d "1" /f

rem Display highly detailed status messages / 0 (Default) - Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "VerboseStatus" /t REG_DWORD /d "1" /f

rem 1 - Enable command-line auditing
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v "ProcessCreationIncludeCmdLine_Enabled" /t REG_DWORD /d "1" /f

Marie SWE · 2026-08-29T09:03:36-0400

Steve C said:
Not true, you can login not connected to the internet even if using an MS account.

I know that didn't work on windows 10.
The network driver got a bad update on a friends win10 with only MS-account. I had to activate the built in admin account to fix the network driver so he was able to log in again.

BruceR · 2026-08-29T09:24:22-0400

Marie SWE said:
I know that didn't work on windows 10.

It did under normal circumstances.

Edwin · 2026-08-29T09:38:58-0400

BruceR said:
It did under normal circumstances.

"Windows" and "normal" are not synonymous with each other!!!

Marie SWE · 2026-08-29T09:40:41-0400

BruceR said:
It did under normal circumstances.

i always make my own things work 100% offline so you dont get restrictions in any way if internet goes down for weeks.
I also always recommend others to set up their systems for 100% offline usage if needed for different things.. you might travel somewhere where there is no internet.. or they mess up and dig off an optical trunk cable so it takes a long time to fix.. and you dont have the option to hook up your desktop to your mobile phone as a hotspot.

also its better for privacy to not have MS, Google, Apple etc accounts tied to your devices.

Steve C · 2026-08-29T11:37:52-0400

spapakons said:
Fearing of using an admin account means you don't trust yourself. For everyone else using the computer, I agree with having his/her separate standard user account. I wouldn't trust anyone else with an admin account even if I was watching what they were doing above their shoulders.

I trust myself but I don't like the idea of giving admin privileges to a malware infected admin account.

How many of you are running as Admin account on your personal computer?

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Microsoft 365 Basic

My Computer My Computer

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

♦ ♦

My Computers My Computers

At a glance

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer