How much security value is gained if I run Windows in a local user account?

Fortitude · Dec 19, 2021

I'm going to install Windows on my laptop and I'm trying to see how much more secure it is when I use Windows as a local standard user instead of as Administrator.

In my current installation I have three accounts, that is an Administrator account, a local Administrator and a local standard user. On a daily basis I use the computer as local user and whenever necessary, for example when installing or uninstalling programs, I'm prompted to enter an Administrator account password. This is occasionally irritating and anyway having three accounts probably takes up unnecessarily some extra space on my hard disk.

Nobody else uses my laptop.

I understand that when I install Windows I'll have created an Administrator account and it will be a Microsoft account. If I recall correctly from what I read in the past, it's advisable to have a second Administrator account, probably a Local one. Should I go ahead and do this and do away with the local standard user account? Which of these accounts would then be used normally?

paulhatton · Dec 19, 2021

Device name DESKTOP-ON9LVC0
Processor 11th Gen Intel(R) Core(TM) i7-1165G7 @ 2.80GHz 2.80 GHz
Installed RAM 8.00 GB (7.64 GB usable)
Device ID 7CD0DB1B-9A54-45CC-859A-9D73DD51928C
Product ID 00330-80000-00000-AA802
System type 64-bit operating system, x64-based processor
Pen and touch No pen or touch input is available for this display

Edition Windows 11 Pro
Version 21H2
Installed on ‎16/‎12/‎2021
OS build 22000.376
Experience Windows Feature Experience Pack 1000.22000.376.0

For what it is worth I have always through all the various Windows OS that have come out only ever had a local account always installed the OS via the F2 or F12 keys and the Bios boot screen and never ever had any trouble over at least decades as I roll back to Windows 3.0 and DOS 6.22 but in more modern times always used a local account and have mostly well since Windows 10 used MS Defender as antivirus with Trojan Remover software and I am no well behaved only safe sites browsing person.

glasskuter · Dec 19, 2021

Fortitude said:
instead of as Administrator.

If you want any control at all over your system don't use a local standard user alone. It has too many limitations. A Standard user is not allowed to install new or even run certain existing apps on the computer. You cannot change Windows passwords and create new Administrator or Standard user accounts. If you want to use a standard user account as your daily driver, that's fine. But be sure to have a second user with administrative rights available. You'll need it.

Fortitude · Dec 19, 2021

glasskuter said:
If you want any control at all over your system don't use a local standard user alone. It has too many limitations. A Standard user is not allowed to install new or even run certain existing apps on the computer. You cannot change Windows passwords and create new Administrator or Standard user accounts. If you want to use a standard user account as your daily driver, that's fine. But be sure to have a second user with administrative rights available. You'll need it.

Thank you for the comments. I understand the limitations that you refer to, as they are indeed typical of my laptop use.

I wonder if these limitations also add some security, for example against malware attempting to change something in Program Files. I mean would the malware be prevented from taking the actions that you mention in the same way that I am as a local user or would this not be a serious barrier to malware?

Ghot · Dec 19, 2021

The only security you gain with a standard account is that Windows will ask you 17 times... are you sure?... whenever you try to do anything.
If you are the only user, and no one else COULD use your computer... then there's nothing wrong with an Administrator account.

You will just need to remember to ask yourself... are you sure?... 17 times. :)

Fortitude · Dec 19, 2021

Ghot said:
You will just need to remember to ask yourself... are you sure?... 17 times. :)

Ghot · Dec 19, 2021

Fortitude said:

Standard accounts are mainly for guests, or when the kid might get on your computer, or when you might have been partying too hardily. Other than that...

Internally... a standard account makes it more difficult for infection or problem to spread if you're already infected, or already have a problem.

But mainly... just remember to double check (think), everything you do, and an Admin account is fine.

And, as has been said about 57,000 times on these forums... use backup software.
That's the most useful software ever invented. :)

Fortitude · Dec 19, 2021

Ghot said:
And, as has been said about 57,000 times on these forums... use backup software.
That's the most useful software ever invented. :)

I totally agree with you about that. I take backups in an insanely regular schedule and on different devices, both locally and to remote locations.

Ghot · Dec 19, 2021

Fortitude said:
I totally agree with you about that. I take backups in an insanely regular schedule and on different devices, both locally and to remote locations.

Standard accounts are for folks that do things like download and install programs like Kazaa or Napster. Or have browsers that look like this...

You don't strike me as someone like that. :)

Now IF there are others in your household that could possibly get on your computer... then sure, a standard account might be useful.

Bree · Dec 19, 2021

Fortitude said:
I understand that when I install Windows I'll have created an Administrator account and it will be a Microsoft account.

Not necessarily. If you install W11 Pro you do have the option to use a local account as the first account.

If I recall correctly from what I read in the past, it's advisable to have a second Administrator account, probably a Local one.

It is always a good idea to have a second local administrator account. This give you a way into the machine if you ever get locked out of your main account.

I'm trying to see how much more secure it is when I use Windows as a local standard user instead of as Administrator.

Not much, really. Actually even when you are signed in as an administrator you are running everything with standard user privileges. Whenever a process wants to run with administrator rights you will be challenged and asked if you really want to allow this. The only real difference between a standard user and an administrator is that an administrator can just click 'OK' to do so. A standard user would have to provide the password of an administrator account to continue.

So if malware tried to run with admin rights you would be asked whether or not to allow it. As long as you don't just click 'OK' without thinking then it is as safe to used an administrator account as it would be to use a standard account.

Fortitude · Dec 20, 2021

OK, I'm sold. I'll create two Administrator accounts and goodbye to the irritating need to enter a password several times during the day!

See you on the other side of my installation

pparks1 · Dec 20, 2021

For my home computer, I just use the single account created when the box was first installed with Windows 10. So, my standard user account that has admin access.

On my work computer, I have to run with a standard user account and then I have a secondary account with admin access. A handful of times per day I have to enter in my secondary account name, and my 20+ character (required) complex password. I survive. I used to have it setup on my finterprint reader. 1 finger was my standard account and the 2nd finger was admin account. But then they disabled the fingerprint readers on all machines, so I lost that luxury.

Fortitude · Dec 20, 2021

pparks1 said:
I used to have it setup on my finterprint reader. 1 finger was my standard account and the 2nd finger was admin account. But then they disabled the fingerprint readers on all machines, so I lost that luxury.

A fingerprint reader is very useful indeed. That's what I use when I switch from one account to an other.

TairikuOkami · Dec 20, 2021

Fortitude said:
I'm trying to see how much more secure it is when I use Windows as a local standard user instead of as Administrator.

Enormously, malware will not be able to auto-elevate, that is basically how all the infections work.
I use admin account with UAC at max, because standard user account would be too bothersome.

Fortitude · Dec 21, 2021

I'm pleased to say that I finished a clean install of Windows and other programs. It took me half a day to prepare and two full days to install everything. The preparation consisted of creating a list of programs, finding and saving most of my programs' settings as well as ensuring that I would have the latest versions on hand for installation. I didn't experience many serious problems although I did waste some time at specific stages. I made relevant notes for the future. I created two Administrator accounts and it has been very easy to install my programs using an Administrator account.

What's also important is that the problem that I mentioned in this posting has been solved.

Fabler2 · Dec 21, 2021

Fortitude said:
I'm pleased to say that I finished a clean install of Windows and other programs. It took me half a day to prepare and two full days to install everything. The preparation consisted of creating a list of programs, finding and saving most of my programs' settings as well as ensuring that I would have the latest versions on hand for installation. I didn't experience many serious problems although I did waste some time at specific stages. I made relevant notes for the future. I created two Administrator accounts and it has been very easy to install my programs using an Administrator account.

What's also important is that the problem that I mentioned in this posting has been solved.

Now all you need to do is make an image backup, to save all the hassle and time, if anything goes feet up again :wink:

Dch48 · Dec 21, 2021

I've never understood the need for anything other than the Microsoft account running as administrator. All the local account stuff seems silly to me. I also set up my computer to automatically log me in at startup. None of that password or PIN stuff.

How much security value is gained if I run Windows in a local user account?

Member

My Computer

Active member

My Computer

aka Mama Glass

My Computers

Member

My Computer

Well-known member

My Computers

Member

My Computer

Well-known member

My Computers

Member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Member

My Computer

Well-known member

My Computers

Member

My Computer

Microsoft 365 Basic

My Computer

Member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Similar threads