Start here
What local admin actually is #
Your computer signs you in as a standard user rather than an administrator. That one setting is the single most effective security change available on a Windows PC, and for most people it changes very little about the working day.
An administrator can change anything on the machine: install software, alter system settings, add drivers, change how security works. A standard user can do everything needed to actually do a job, but cannot make changes that affect the whole computer.
Historically everybody was an administrator, because it was simpler. That stopped being a sensible default a long time ago, for the reason set out in the next section, and standard accounts are now expected practice rather than an unusual restriction.
This is worth saying plainly, because it is how it can feel. Removing admin rights is not a judgement about you, your competence or your seniority. It applies to everybody, including directors, including the people who look after your IT, and including us.
Our own engineers do their day to day work on standard accounts too, and use a separate account when they need to make changes. That is the whole idea.
The reason
Why we remove it #
There is one reason that matters, and it is worth understanding properly rather than taking on trust.
Anything you run has exactly the permissions you have. Open a document, click a link, run an installer, and whatever that thing does, it does as you. If you are a standard user, it is a standard user. If you are an administrator, so is it.
That means the same unlucky click has two completely different outcomes depending on one setting.
Nothing about the left hand column depends on you spotting the problem. It works even when somebody has a genuinely convincing bad day, which is the point. Security that only works when everybody is alert is not security.
It is the same reasoning as not carrying every key to the building on your person at all times. Not because you would misuse them, but because losing the bunch once should not mean losing everything.
There is a secondary benefit that matters more than it sounds. Machines where nobody can change things stay in the state we built them in. They break less often, behave the same as everyone else's, and are far quicker for us to fix when something does go wrong, because there are no surprises.
For you
What changes for you #
Less than people expect. Most staff notice nothing at all after the first week.
Do
- Use every application you normally use.
- Save, open, print and share files as usual.
- Change your wallpaper, display, mouse and sound settings.
- Connect to Wi-Fi, and add most printers.
- Update your own documents and preferences.
- Work exactly as you did yesterday, in almost every respect.
Do not
- Install new software yourself.
- Install drivers or hardware utilities.
- Change settings that affect the whole machine.
- Turn off security software.
- Alter other people's files on a shared computer.
The one visible difference is the prompt. Where Windows used to ask you to confirm something with a Yes, it now asks for an administrator username and password. When you see that, it means the thing you are doing needs us rather than that you have done something wrong.
If you hit that prompt and it is stopping you working, that is a support ticket, not a problem you should try to work around. It is usually a couple of minutes at our end.
Downloading a portable version of an app to avoid the prompt, or running something from a memory stick because it does not need installing, defeats the point entirely and is exactly the route the risky software takes. If you need something, ask, and if the answer is no we will explain why and suggest an alternative.
For you
Getting software installed #
This is the practical question. Ask us, and we will do it. On some computers you can also help yourself, which is worth a quick look first.
Just ask us
This works on every machine we look after, whichever way it is set up. Get in touch the usual way and tell us:
- What the software is, and a link to it if you have one.
- What you need it for. Not to justify yourself, but because there is often something you already have a licence for that does the same job.
- Whether it is urgent, so we can prioritise it properly.
We will check it is safe and appropriately licensed, then install it remotely. Most requests are dealt with the same day.
You may also have a Company Portal
Depending on how your computer is set up, you may have an app called Company Portal, or something similar, in your Start menu. It is a small catalogue of software already approved for your organisation, and anything in it you can install yourself straight away without admin rights and without waiting for us.
Not every machine has one, because computers are managed in a few different ways and only some of them include it. If you cannot find it, nothing is wrong and nothing is missing from your setup. Use the route above instead.
Have a look in your Start menu before raising a ticket. If it is there and what you need is in it, you are installed and working in a minute rather than waiting on us.
If it is there but what you need is not, tell us what you use regularly. Where several people want the same thing, we can add it so everybody can help themselves in future.
A lot of software is free for personal use and chargeable for business use. Installing it at work without a licence is a genuine risk to your employer rather than a technicality. Checking that is part of why requests come through us, and it is not us being obstructive.
Practicalities
If you genuinely need it #
A small number of roles have a real, ongoing need to change things on their own machine. That is a conversation rather than a refusal.
Developers, engineers running specialist tooling, and people working with equipment that needs constant driver changes are the usual cases. If that is you, tell us what you are trying to do and we will work out the right arrangement.
Options we would look at, roughly in the order we would prefer them:
| Approach | What it means |
|---|---|
| Fix the underlying need | Often the requirement is one specific action, which we can allow without granting full admin. Worth exploring first, because it usually solves the problem completely. |
| Elevate on request | You keep a standard account, and we grant the specific thing you need at the moment you need it. Good for occasional requirements. |
| A separate admin account | You sign in normally as a standard user and use a second account only when making changes. This is how our own engineers work, and it is what certification expects. |
| Standing admin on one machine | The last resort, agreed with whoever owns IT at your organisation, and recorded. It carries conditions and we would review it periodically. |
Add somebody as a permanent administrator because installing things is occasionally inconvenient. That is the request we get most often, and it is the one that undoes the protection for everybody on the network rather than only the person asking.
If it is genuinely slowing you down, tell us how often and for what. That usually leads somewhere better than admin rights would have.
Background
Certification and insurance #
For most businesses this is not only a good idea, it is a written requirement.
Cyber Essentials requires that administrative accounts are not used for everyday work such as email and browsing, and that admin rights are granted only where there is a documented need. An organisation where everybody is a local administrator does not pass, and cannot honestly claim it does.
Cyber insurance renewal questionnaires increasingly ask about privileged access directly. Answering those accurately matters, because a policy that assumes controls you do not have is a policy that may not pay out.
Customer security questionnaires ask the same question, and for anyone selling to larger organisations or the public sector, the answer affects whether you stay in a procurement process.
Standard accounts are one part of a wider set of protections that work together. There is more on the rest in our Business Premium guide. If your organisation uses Microsoft Intune, and many do, there is more on how those machines are built in Your Intune migration.
Support
Common questions #
I have always had admin. Why now?
Because what it costs when something goes wrong has changed considerably, and because it is now a requirement for certification and increasingly for insurance. It is not a response to anything you have done, and the change applies to everybody at once.
I am the business owner. Surely I keep mine?
We would recommend not, and we would say the same to any director. Senior people are targeted more than anyone else precisely because of what their accounts can reach, so an owner with permanent admin rights is the most valuable single account in the business.
What we would suggest instead is a separate administrator account you use deliberately, on the rare occasions you need it. Full control, without carrying it around all day.
Does this mean you do not trust me?
No, and we understand why it can feel that way. It assumes that anybody can have an unlucky moment, which includes us. Our own engineers work on standard accounts for exactly the same reason.
What if I need something installed urgently?
Ring us rather than emailing, and say it is urgent and why. We can usually install remotely within minutes during working hours. If you have a Company Portal, it is worth a quick look first, since what you need may already be in it.
Will my existing software stop working?
Almost certainly not. Normal applications run perfectly well as a standard user. A small number of older programs insist on admin rights to run at all, which is a flaw in them rather than in the policy. If you hit one, tell us and we will find a way to make it work.
Can I install browser extensions?
Depending on how your organisation is set up, extensions may be managed centrally so that only approved ones can be added. If one you need is blocked, ask us. Extensions can read everything you do in the browser, so they are worth a moment's thought.
It is asking for a username and password I do not have
That is the administrator prompt, and it means the action needs us. Do not guess at it and do not ask a colleague for theirs. Contact us and tell us what you were trying to do.
What about my own personal laptop?
This applies to company managed machines. What you do on your own equipment is your business, though the same reasoning applies at home and it is worth considering a standard account there too.
Getting help
If this is getting in the way of your job, please tell us rather than putting up with it. There is usually a way to give you what you need without handing over the keys to the whole machine, and we would much rather hear about the friction than have you working around it.