If your everyday Windows login can install anything, change anything and reach everything, then so can any malware that runs in your name - and so can any mistake. Splitting daily work from admin rights is one of the oldest, cheapest and most ignored protections in IT.
Least privilege simply means each account holds only the power its daily job needs. In practice for a small office it comes down to one change: work in a standard account, and keep a separate administrator account whose password is typed only when something genuinely needs installing or changing. Windows is designed for exactly this - the admin prompt appears, you type the admin password, the task runs, and you drop back to a safer account. This page explains what this split actually stops, what it honestly does not, and how to set it up without annoying the whole office.
A standard account cannot install most software, change system-wide settings, or tamper with security tools. Malware that lands while you browse or open attachments inherits your rights - so in a standard account, a large class of infections simply fails to install, and many settings-changing tricks fail with it.
The same applies to human error. Deleting the wrong folder, approving the wrong prompt, running the wrong downloaded fixer - all of these do less damage when the account cannot touch the whole system. Least privilege is as much an accident limiter as an attacker limiter.
The pattern is identical on each machine: one named administrator account with a strong unique password kept in the password manager, and one standard account per person for daily work. The person signs in as standard; when a real admin task appears, the prompt asks for the admin credentials.
Roll it out in the same sitting as the password manager work from this series, one PC at a time, and test the person's real daily software before you leave. Accounting and printing are the two things to verify on the spot.
Server admin accounts deserve the strictest version of this rule. The built-in Administrator should have a long unique password, be renamed or disabled where your setup allows, and never be used for daily work or email. Real administration happens through named individual admin accounts, so the logs can show who did what.
Shared anonymous admin access is how offices end up unable to answer the simplest incident question: which person made this change. Named accounts are accountability you will be grateful for on exactly one bad day - and that day justifies them.
A standard account is not a force field. Some malware runs happily with user-level rights and can still encrypt that user's documents - which is why backups and updates stay on the essentials list. A determined user can also still be phished into typing the admin password into a fake prompt.
So treat the split as one strong layer, not the wall. Its honest value: it quietly blocks a wide class of automatic damage, slows down the rest, and turns rare deliberate actions into conscious decisions. For a free, built-in setting, that is an excellent return.
Every essential in this guide is explained with full knowledge and installation in the IT Security Essentials video.
Watch Full VideoIt stops silent and accidental installs, which is the point. Legitimate installs still work: the UAC prompt appears and the admin password is entered - by IT, or by the user if your office chooses to allow it for that machine. Most office software, once installed, runs perfectly under a standard account.
No. It reduces how much damage a successful infection can do and blocks many install attempts outright, but malware can still run within a user's own files. It works alongside updated antivirus and current patches, not instead of them.
Make the risk concrete rather than arguing principle: their account also holds email and banking access, so a single bad download gets full power. A common compromise is an admin account they use only for admin tasks, with a separate standard account for email and browsing - same person, separate keys.