Windows Non-Administrator User Account
From TSG Library of Knowledge
Non-Administrator User Accounts,
- In Windows 2000 they're called Restricted User Accounts.
- In Windows XP they're called Limited User Accounts.
- In Windows Vista and 7 they're called Standard User Accounts.
Using a Non-Administrator User Account for your daily computer use is a fast and simple way to greatly increase your computer's security.
While in a Standard User Account you cannot modify or write to many important system files/folders, Stopping most malware from being able to harm your computer.
You can always create a Non-Administrator User Account and try using it for your daily use, If you don't like it you can easily switch back to an Administrator User Account.
Most people don't make system-wide changes everyday they use their computer, and for the times that they need to it's very easy for them to gain Administrator credentials,
Ways to gain Administrator credentials
Built-in
Log out/in
You can log out of your Standard User Account and in to an Administrator User Account to perform any actions that require Administrator credentials, When finished you can log back into your Non-Administrator User Account.
Any open windows in your User Accounts close when you log out, So remember to save anything you have open before logging out.
Fast User Switching
Fast User Switching or FUS is a feature in Windows XP, Windows Vista, and Windows 7 that allows you to switch to a different User Account to perform Administrator User actions similar to logging out/in, The difference though is that FUS doesn't close your open windows when switching accounts, So you can be logged into more than one account at the same time.
Run As
Run As is a feature in Windows 2000 and Windows XP that allows you to run programs as a different user than the currently logged on user, So you can run programs as an Administrator User from your Non-Administrator User Account.
User Account Control
User Account Control or UAC is a new feature in Windows Vista and Windows 7 that causes most programs to run as though from a Standard User Account, while allowing an Administrator User Account to give permission when a program requests/requires Administrator credentials.
For more info about UAC see Windows User Account Control.
Third-party
SuRun
Advantages of using a Non-Administrator User Account
By using a Non-Administrator User Account you greatly increase your computer's security a few ways.
- Any malware that gets onto your computer is restricted to only that User Account, the malware can't make changes to or damage important system files, Malware also can't affect other User Accounts on the same computer.
- Your current security software for example your AntiVirus will be stronger as well because malware won't be able modify/damage any of the AntiVirus' files or terminate any of the Antivirus' processes to try and bypass it.
- Many vulnerabilities found in Windows Operating Systems in the past wouldn't have worked in Non-Administrator User Accounts.
- If a Non-Administrator User Account gets infected with malware you can just delete that User Account and create a new one, Because the malware will be restricted to only that User Account.
- Easy for you the user to gain Administrator credentials to perform Administrator tasks, But much harder for malware.
Disadvantages of using a Non-Administrator User Account
Now of course with any increase in security there is often a trade-off of convenience.
- To make system-wide changes, update software or install/uninstall programs you will need to log into an Administrator User Account.
- Some programs still don't work too well in Non-Administrator User Accounts because of older Windows Operating Systems not having Non-Administrator User Accounts, And because of newer Windows Operating Systems using the Administrator User Account by default, But because of Windows UAC many developers have started writing their programs to work under Non-Administrator User Accounts.
What can be done in a Non-Administrator User Account
- Browsing the Internet.
- Writing and Receiving Emails.
- Watching Videos, listening to music, viewing Pictures
- Playing games (A few games are poorly coded and do not allow this)
- Editing office documents: Word, Excel, and More
- Editing Pictures and videos
- Manipulating your own files: moving, copying, deleting, etc
- Managing your own account, changing your own password
- Programming (except testing when the programmed task itself necessitates admin privileges)
- Connecting and using Plug and Play hardware
- Updating an antivirus and performing Anti-virus scans within the account.
What can't be done in a Non-Administrator User Account
Software Installations cannot be performed under a Non-Administrator account because they require access to the Global Hives of the Windows Registry and to the Program Files Folder. Likewise Software cannot be uninstalled by a non-administrator.
Windows Updates require an administrator account because they modify Windows as an Operating System. Changes to Windows are necessarily system wide. Removing Updates is also an administrator task.
Modifying another user's files needs the correct file permissions to be allocated. Most users are the owner of their own files. As such only they or an administrator can change file permissions. While a Standard user may even be granted full control over another user's space, they cannot modify the file permissions themselves.
Modifying another user's account
Defragmenting the Hard Drive is an administrator task because it require raw access to the hard drive at a level at which permissions are irrelevant. Since other user spaces are protected from modification by standard users, they cannot be allowed such raw access. Running File Recovery programs against the hard drive needs an administrator account for the same reason.
Formatting the hard drive or Modifying Partitions
Controlling the processes started by another user requires an administrator account.
Managing the services running on the computer requires an administrator account.
Running Certain programs, especially older ones, needs higher privileges because they have been poorly programmed so as to expect raw access to files which Windows does not want to give. This does not necessarily mean that they are malicious programs but they perform tasks which can pose a hazard to the machine. It is often possible to find an update or replacement which doesn't need these privileges.
These tasks are all important; indeed they're the sort of tasks that are talked about at TSG. This is because they are Administrator tasks, to be performed with your brain engaged to keep your computer working. They are also potentially dangerous tasks. It is impossible to operate a healthy computer without an administrator account. However it is unwise to perform tasks such as browsing the internet (a huge security risk) with an account allowed to fiddle the registry, juggle partitions, control every user's files, or just format your hard disk.
How to find out if you're using an Administrator or Non-Administrator User Account
If you're not sure if your using an Administrator or Non-Administrator User Account then you're most likely using an Administrator User Account since all versions of windows give you an Administrator User Account by default.
But to be sure whether you're using an Administrator or Non-Administrator User Account follow the instructions for your version of Windows below.
Windows 7
Windows Vista
- Click the Start button
- Click Your Account Logo at the top right
- On the right hand side of the new page, with your account Logo and account name will be Administrator or Standard User.
Windows XP
Windows 2000
How to set up a Non-Administrator User Account
Windows 7 or Windows Vista
- Click the Start button
- Click Control Panel
- Click Add or remove user accounts under User Accounts and Family Safety
- Click Create a new account
- Create a name for the new account
- Select Standard user
- Click Create Account button
Windows XP
- Click Start > Control Panel > User Accounts
- Click Create a new account
- Create a name for the new account
- Under Pick an account type select Limited
- Click Create Account
Windows 2000
techguy.org/w1516
