Employees should handle daily work with standard accounts. Keep administrator access for employees only for approved IT changes, preferably in a separate, protected login.
It often starts with a simple favor: “I need to install a printer,” or “This app needs an update.” Granting admin rights fixes the issue fast. The trouble is those privileges tend to stick around long after the job is done. From that point on, the person can approve new software and change settings that would normally go through IT. If the wrong program is installed, or a criminal gets into that account, those higher permissions make the damage worse.
For routine work, use standard accounts. Save admin rights for the moments you truly need them.
What admin rights really let someone change
Admin users can do far more than a standard user on a single computer.
On Windows, anyone in the local Administrators group effectively controls that device. Microsoft’s guidance on local accounts recommends keeping that group small.
Depending on how the device is managed, an admin may be able to:
- Install or remove programs
- Add drivers for printers and other hardware
- Create, modify, or delete local user accounts
- Change system-level settings
- Alter permissions on folders and files
- Install background services that keep running
- Adjust some security controls
Macs also have standard and admin roles. Apple notes that admins can manage other users, install and remove software, and change settings. Apple recommends limiting the number of administrative users and using a standard account when admin rights aren’t required.
Local admin access applies to the computer itself. It isn’t the same as Microsoft 365, Google Workspace, network, or server admin roles, which can manage email, cloud files, user accounts, or multiple systems. Someone might be a local admin on a laptop without being a Microsoft 365 admin. Review each type of access on its own.
Limit administrator access for employees to cut risk
Software runs with the permissions of the person who launches it. That’s a problem if a fake installer or a bad attachment asks for approval and the user clicks Yes with an admin account.
With admin approval, unwanted programs can add system components, change settings, or affect other users. Windows uses User Account Control to request permission before many system changes. A user already signed in as an admin can approve those prompts themselves. With a standard account, Windows asks for an admin username and password first. Microsoft calls the standard account the recommended and more secure way to use Windows.
Keeping people on standard accounts also limits who can alter security settings without a second look. Instead of employees approving every installer, IT can verify the source, version, and required permissions.
CISA urges organizations to control local administrator access and restrict who can install software. The Australian Cyber Security Centre includes limiting admin privileges in its Essential Eight and advises creating separate accounts for admin work (Cyber.gov.au).
Standard accounts cover day-to-day work
Standard users can still do normal business tasks, such as:
- Reading and sending email
- Browsing the web
- Working in Microsoft 365 or Google Workspace
- Using approved business apps
- Joining online meetings
- Printing to already-installed printers
- Opening and saving files
- Changing personal preferences that don’t impact others
Some apps install per user and don’t need admin rights. Others touch protected areas, add drivers, or install services and do need admin approval.
Don’t grant permanent admin rights just to update one program. IT can approve the install, push the update remotely, or use a separate admin login for that one task. Older software may expect admin privileges; test it first. Often IT can update it, change its settings, or grant access to only the folders it needs.
How to handle installs without standing admin rights
Your team can still get the tools they need—without keeping admin permissions.
Have IT install approved apps
Your internal IT team or managed IT provider can install software remotely. That extra step also confirms the installer is from the vendor and that the version is supported.
Use centralized software deployment
With managed devices, you can push approved apps and updates automatically. The exact approach depends on your operating system and device management tools.
Approve one-off requests
When an install needs admin approval, the employee can contact IT. IT reviews the request and enters the admin credentials without sharing the password.
Grant time-boxed admin rights
If someone’s job involves testing or installing software, give them a separate admin account you enable only for the approved task—then disable it again.
Keep a separate admin login for technical roles
Employees who regularly perform technical work can have a second, admin-level account. They should use their standard account for email, web, and daily tasks, and sign into the admin account only when extra permissions are required.
Who should have admin rights?
Limit admin permissions to people who truly need them:
- Internal IT staff
- Your managed IT provider
- Approved technical employees
- A software specialist responsible for a specific system
Business owners should stick to a standard account for routine work too. Owning the company doesn’t mean you need permanent admin rights on every device.
Your IT provider should maintain a managed admin account to support each computer. Protect that password and don’t share it with staff. Avoid using the same local admin password across all machines—if it’s stolen from one, it could unlock the rest. Each device should have a unique local admin password or use a management tool that controls those passwords.
Remove admin rights safely, step by step
1. Identify who has local admin now
Review the local Administrators group on every Windows PC and the admin users on every Mac. Include old, shared, vendor, and setup-time accounts.
2. Verify the business reason
Ask why each person needs admin rights. Keep it only where there’s a clear, ongoing requirement. Occasional app updates aren’t a reason for permanent access.
3. Confirm IT has working admin access
Before removing employee privileges, make sure your IT team or provider can sign in with a protected admin account. Test it on each device so you don’t lock yourselves out.
4. Test critical applications
Open, update, and use the apps each employee needs while signed in as a standard user. Fix any issues before taking away admin permissions.
5. Change the user to standard
Remove the user from the local Administrators group or switch the account type. Have the employee sign out and back in so the change takes effect.
6. Explain how to request installs or changes
Provide a single place to ask for help, and what details to include (app name, why it’s needed, and the official download page).
7. Recheck access when roles change
Review admin rights when someone changes jobs, takes on new duties, or leaves. Add it to your regular access reviews.
Frequently asked questions
Can a standard user install software?
Sometimes. Apps that live only in the user’s profile may install without admin approval. Software that modifies protected system files, adds drivers, or installs background services usually needs admin credentials.
Will removing admin rights stop employees from working?
Daily business apps should keep running. Test older or specialist programs before rolling this out company-wide.
Does removing admin access block malware?
It limits what many malicious programs can change, but it won’t stop every attack. You still need supported software, security updates, device protection, email security, two-step login (multi-factor authentication), and tested backups.
Should the business owner keep admin rights?
Use a standard account for everyday work. If you need admin access for an approved task, use a separate admin login and protect its password.
Is local admin the same as Microsoft 365 admin?
No. Local admin controls a single computer. Microsoft 365 admin roles can manage cloud users, email, files, security, and more. Both should be limited and reviewed.
Sources and further reading
- Microsoft Learn: Local accounts
- Microsoft Learn: How User Account Control works
- Apple Support: Set up your Mac to be secure
- CISA: StopRansomware Guide
- Australian Cyber Security Centre: Restricting administrative privileges
For offices around Panama City and Bay County, keeping admin rights tight helps prevent outages and surprises. If you’d like help reviewing who has access and setting up safer defaults, please get in touch.
—
