How many of you are running as Admin account on your personal computer?

pseymour · Friday at 2:20 PM

I am convinced by your sample size of one.

Steve C · Saturday at 2:51 AM

win11freak said:
Just curious, for the security gurus here that are very cautious on they do on their own personal machine, are you still running as a Standard Local Account?

On all PCs I use a standrd account for daily use and only use the admin account for PC maintenance. Both are MS accounts.

Steve C · Saturday at 2:53 AM

Marie SWE said:
Question:

For real high security i would not even use Windows.....
Reason...... Windows have to big market-share and therefore is the biggest target out there..... and there is literally millions of black/gray-hat hackers and crackers and even state-sponsored ones that spend all days just to find new ways to infect or to exploit windows machines.

Always local account as online account require you to always have internet.. that is bad.. you need to be able to work totally offline.

As i do need windows for banking and some other things that is really sensitive..... Here is what i have right now as a secure windows solution.

First i have Linux installed as a host-OS.... On that install i have a firewall with block all traffic as default and ask for permission.. both inbound and outbound traffic.
... The outgoing traffic is as important to control as the incoming.. windows and most firewalls have Block all incoming and allow ALL outgoing traffic.
This is bad.. as if you get a spyware or a malware that makes a tunnel connection outgoing for the attacker to abuse..... the firewall rule with "allow all outgoing traffic" will just let it happen.
I also have real-time network monitoring, so if i start to see traffic going to another country, then something is wrong.
Then i have Windows installed as a VM.. i installed everything and tweaked it offline. Then after i was finished with all installs etc. etc. i made a clone of that VM.
I only using the clone.. never the original one... This way i have an more or less an Immutable windows version that i just delete now and then and make a new clone of the original to use again.

But if i couldn't cheat like that and had to use a bare-metal install.
I would set up the install and make all hardening tweaks etc. add a firewall that actually control outbound traffic as well with block all as default and ask for permission. add software i need.. and then create a user account with no admin rights to use.
Then i would do an disk-to-image clone of the setup...... And..... on the first tiny sign, or with just a bad feeling, or just a bad dream while sleeping.. i would wipe the disk and restore the disk clone.

As it just takes minutes or say half an hour to an hour on a slower system.. why even take a chance of not wiping the system if you get a bad feeling.

Not true, you can login not connected to the internet even if using an MS account.

spapakons · Saturday at 5:51 AM

Fearing of using an admin account means you don't trust yourself. For everyone else using the computer, I agree with having his/her separate standard user account. I wouldn't trust anyone else with an admin account even if I was watching what they were doing above their shoulders.

TairikuOkami · Saturday at 5:56 AM

For years I used system admin, but I use admin with full UAC now, that will do. MSA provides a perfect protection from remote attacks.

Code:

rem =================================== Windows Policies ===================================
rem --------------------------------- User Account Control ---------------------------------

rem https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd835564(v=ws.10)
rem Reason to set UAC to Always Notify - https://learn.microsoft.com/en-us/previous-versions/technet-magazine/dd822916(v=msdn.10)
rem https://daniels-it-blog.blogspot.com/2020/07/uac-bypass-via-dll-hijacking-and-mock.html
rem https://www.bleepingcomputer.com/news/security/bypassing-windows-10-uac-with-mock-folders-and-dll-hijacking/
rem There are really only two effectively distinct settings for the UAC slider - https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105

rem 0 - Elevate without prompting / 1 - Prompt for credentials on the secure desktop / 2 - Prompt for consent on the secure desktop / 3 - Prompt for credentials / 4 - Prompt for consent / 5 (Default) - Prompt for consent for non-Windows binaries
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "1" /f

rem 0 - Automatically deny elevation requests / 1 - Prompt for credentials on the secure desktop / 3 (Default) - Prompt for credentials
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorUser" /t REG_DWORD /d "0" /f

rem 2 (Default)
rem reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableFullTrustStartupTasks" /t REG_DWORD /d "0" /f

rem Detect application installations and prompt for elevation / 1 - Enabled (default for home) / 0 - Disabled (default for enterprise)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableInstallerDetection" /t REG_DWORD /d "1" /f

rem Run all administrators in Admin Approval Mode / 0 - Disabled (UAC) / 1 - Enabled (UAC)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "1" /f

rem Only elevate UIAccess applications that are installed in secure locations / 0 - Disabled / 1 (Default) - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableSecureUIAPaths" /t REG_DWORD /d "1" /f

rem 0 (Default) = Disabled / 1 - Enabled
rem reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableUwpStartupTasks" /t REG_DWORD /d "0" /f

rem Allow UIAccess applications to prompt for elevation without using the secure desktop / 0 (Default) = Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableUIADesktopToggle" /t REG_DWORD /d "0" /f

rem https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/932a34b5-48e7-44c0-b6d2-a57aadef1799
rem 0 - Disabled / 1 - Enabled (Default)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableVirtualization" /t REG_DWORD /d "0" /f

rem Admin Approval Mode for the built-in Administrator account / 0 (Default) - Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "FilterAdministratorToken" /t REG_DWORD /d "1" /f

rem Allow UIAccess applications to prompt for elevation without using the secure desktop / 0 (Default) - Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "1" /f

rem Administrator Protection for Admin Approval Mode / 1 - Disable / 2 - Enable
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "TypeOfAdminApprovalMode" /t REG_DWORD /d "1" /f

rem Enforce cryptographic signatures on any interactive application that requests elevation of privilege / 0 (Default) - Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ValidateAdminCodeSignatures" /t REG_DWORD /d "1" /f

rem Display highly detailed status messages / 0 (Default) - Disabled / 1 - Enabled
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "VerboseStatus" /t REG_DWORD /d "1" /f

rem 1 - Enable command-line auditing
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v "ProcessCreationIncludeCmdLine_Enabled" /t REG_DWORD /d "1" /f

Marie SWE · Saturday at 9:03 AM

Steve C said:
Not true, you can login not connected to the internet even if using an MS account.

I know that didn't work on windows 10.
The network driver got a bad update on a friends win10 with only MS-account. I had to activate the built in admin account to fix the network driver so he was able to log in again.

BruceR · Saturday at 9:24 AM

Marie SWE said:
I know that didn't work on windows 10.

It did under normal circumstances.

Edwin · Saturday at 9:38 AM

BruceR said:
It did under normal circumstances.

"Windows" and "normal" are not synonymous with each other!!!

Marie SWE · Saturday at 9:40 AM

BruceR said:
It did under normal circumstances.

i always make my own things work 100% offline so you dont get restrictions in any way if internet goes down for weeks.
I also always recommend others to set up their systems for 100% offline usage if needed for different things.. you might travel somewhere where there is no internet.. or they mess up and dig off an optical trunk cable so it takes a long time to fix.. and you dont have the option to hook up your desktop to your mobile phone as a hotspot.

also its better for privacy to not have MS, Google, Apple etc accounts tied to your devices.

Steve C · Saturday at 11:37 AM

spapakons said:
Fearing of using an admin account means you don't trust yourself. For everyone else using the computer, I agree with having his/her separate standard user account. I wouldn't trust anyone else with an admin account even if I was watching what they were doing above their shoulders.

I trust myself but I don't like the idea of giving admin privileges to a malware infected admin account.

Alejandro85 · Sunday at 11:26 AM

spapakons said:
Fearing of using an admin account means you don't trust yourself.

No.

It means you can be fooled, you can make mistakes and someone else can outsmart you, it's admiting that having a safety net is a good thing.
Have a look at the Principle of Least Privilege.

spapakons · Sunday at 11:52 AM

Alejandro85 said:
No.

It means you can be fooled, you can make mistakes and someone else can outsmart you, it's admiting that having a safety net is a good thing.
Have a look at the Principle of Least Privilege.

As another poster said, I would probably hit OK at UAC prompt all the time without reading it, there is no point having it enabled it. Also most old applications and games won't run properly unless you set the shortcut to Run as Administrator. So there is very little point for me using a standard user account. I use an Administrator account with UAC set to minimum for convenience.

pparks1 · 2026-08-31T11:27:35-0400

spapakons said:
As another poster said, I would probably hit OK at UAC prompt all the time without reading it, there is no point having it enabled it. Also most old applications and games won't run properly unless you set the shortcut to Run as Administrator. So there is very little point for me using a standard user account. I use an Administrator account with UAC set to minimum for convenience.

Yeah, I don't know. When you get a UAC prompt come up out of the blue, i ponder a bit thinking....what am I trying to do that requires admin privs. I don't just blindly click on allow unless I am absolutely expecting the prompt.

TairikuOkami · 2026-08-31T11:47:11-0400

pparks1 said:
When you get a UAC prompt come up out of the blue, i ponder a bit thinking....

Exactly, I have most lolbins covered with IFEO, if I get UAC prompt out of nothing, I will never allow it.

neemobeer · 2026-08-31T12:02:00-0400

Even members of a privileged group such as 'Administrators' normally operate as 'standard users' until you get a UAC prompt which is what starts a process with a privileged access token. With that being said the main difference between operating with a standard user and an admin account is the difference between clicking 'Ok' (admin) and entering admin creds and clicking Ok. If you are blindly doing either then neither operating model will protect you.

To add fuel to the flame, many applications can and do "install" in user mode. They install in your user profile, don't require admin privs to do so can can cause plenty of malicious actions, so no protection in either operating model.

spapakons · 2026-08-31T13:50:00-0400

My thoughts exactly. Unless you are careful enough you can do damage even as Guest, so why make your life difficult and use a standard user account? And as Spiderman movie says "we great power comes great responsibility" or in our case using an Administrator account might make us better watch what we do, while with a standard user account we might be more careless. Much like wearing the seatbelt and thinking you are invincible and start speeding.

neldog · 2026-08-31T14:04:45-0400

I run on an Admin LOCAL account and have always for as long as I can remember.

pseymour · 2026-08-31T14:17:13-0400

Unless you are careful enough you can do damage even as Guest, so why make your life difficult and use a standard user account?

Because it is factually much safer to do so. Any process running under your account has the privileges of your account. The fewer privileges, the safer the process is to have running. That's just a fact.

If we're going to talk about lowest common denominator and people "doing stupid things," then we should just turn the computers off and go outside. Is it safe to use a pen? Well not if I stab myself in the eye with it.

If the question is which is safer, admin or user, the answer is obvious. I get it though; people have a vested interest in that not being true, because it would mean they've been wrong not to do the safer thing all along.

spapakons · 2026-08-31T15:08:08-0400

Sure using a limited standard user account, or even a parental controlled child account is much safer, but more inconvenient and I wouldn't do it on my own home PC.

How many of you are running as Admin account on your personal computer?

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Microsoft 365 Basic

My Computer My Computer

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

♦ ♦

My Computers My Computers

At a glance

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Microsoft 365 Basic

My Computer My Computer

At a glance

Defender of the Tinfoil Hat

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer

My Computers