Article Summary: Employees should use standard accounts for email, web browsing, and everyday work. Limit administrator access to approved IT tasks, and protect it with a separate account. This post explains why permanent admin rights raise your risk, how to handle software installs without them, and how to remove administrator access safely.

Administrator access often starts with one request. An employee needs to install a printer, update a specialized program, or change a setting on their computer.

Giving them administrator access gets the job done. The problem is that the access usually stays long after the task is finished.

From then on, that employee can approve other software installs and make changes that would normally require IT. If they install the wrong program, or someone takes over their account, those same permissions can be used against the computer.

At Pacific Edge Technology, we help businesses across Richland, Kennewick, and Pasco clean up administrator access on their computers. The rule is simple. Employees use standard accounts for everyday work, and administrator access stays reserved for tasks that truly need it.

What administrator access allows someone to do

An administrator has far more control over a computer than a standard user.

On Windows, members of the local Administrators group have full control over that computer. In its guidance on local accounts, Microsoft recommends limiting the number of users in that group.

Depending on how the computer is managed, an administrator may be able to:

Install and remove software
Add drivers for printers and other equipment
Create, change, or remove user accounts
Change system settings
Change permissions on files and folders
Install services that keep running in the background
Change some security settings

Mac computers also have standard and administrator accounts. Apple says administrators can install and remove software, manage other users, and change settings. Apple recommends limiting the number of administrators and using a standard account whenever admin rights aren’t needed.

Local admin vs. cloud admin

Local administrator access applies to the computer itself. It’s different from administrator access in Microsoft 365, Google Workspace, your network, or your servers. Those accounts may control email, cloud files, user accounts, or several systems at once.

An employee might have administrator access to their laptop without being a Microsoft 365 administrator. Review both types of access separately.

Why permanent administrator access increases your risk

When an employee launches a program, it normally starts with that employee’s permissions.

Employee working on a laptop with a standard user account instead of administrator access

If a program asks for administrator approval and the employee grants it, the program may install system components, change settings, or reach information that belongs to other users.

That matters when someone downloads a fake installer, opens a harmful attachment, or installs software from an untrusted website. The employee may think they’re approving a real update. In reality, they’re giving a harmful program permission to change the computer.

How User Account Control fits in

Windows uses User Account Control to ask for approval before many administrative changes. An employee signed in with an administrator account can approve the request themselves. A standard user, on the other hand, has to enter an administrator’s credentials.

Microsoft calls the standard account the recommended and more secure way to use Windows.

Standard accounts also limit how many people can change security settings without review. Since employees can’t approve every install themselves, IT gets a chance to check each program, where it came from, and what permissions it needs.

What security agencies recommend

CISA advises businesses to control local administrator access and restrict who can install software. The Australian Cyber Security Centre also lists restricting administrative privileges among its core security measures and recommends separate accounts for admin work.

Standard accounts work fine for everyday tasks

A standard account handles normal business work, including:

Reading and sending email
Browsing the web
Working in Microsoft 365 or Google Workspace
Using approved business applications
Joining online meetings
Printing to an installed printer
Opening and saving files
Changing personal settings that don’t affect other users

Some applications install for one user without administrator access. Others need admin approval because they add drivers, services, or files in protected parts of the computer.

An employee shouldn’t get permanent administrator access just because one program needs an update. IT can approve the install, push the update remotely, or use a separate admin account for that task.

Older business applications sometimes expect the user to have admin rights. Test those programs before changing permissions. In many cases, IT can update the application, adjust its settings, or grant access to the specific folders it needs.

How to manage software installs without permanent administrator access

Staff can still get software installed and updated without keeping admin rights.

IT technician approving a software installation remotely for an employee

Let IT install approved software

Your IT team or provider can install programs remotely. This also lets them confirm the installer came from the real software company and that the version is supported.

Use managed software deployment

Businesses with managed computers can push approved applications and updates to employees automatically. Nobody has to run an installer. The exact method depends on your operating system and device management tools.

Approve individual requests

When an install needs admin approval, the employee contacts IT. IT reviews the request and enters the credentials without ever sharing the password.

Provide time-limited administrator access

Some roles need to install or test software as part of their job. Give those employees a separate admin account that’s turned on only for the approved task, then turned off afterward.

Create a separate administrator account

Employees who regularly do approved technical work can have a separate admin account. They should keep using their standard account for email, browsing, and normal work. They switch to the admin account only when a task requires the extra permissions.

Who should have administrator access?

Limit administrator access to people whose work requires it. That may include:

Your internal IT staff
Your IT provider
An approved technical employee
A software specialist responsible for a particular system

Business owners should use standard accounts for daily work too. Owning the company doesn’t require permanent admin rights on every computer.

Protect the IT provider’s admin account

Your IT provider should keep a managed administrator account so they can support each device. Protect its password, and never share it with employees.

Using the same local admin password on every computer creates another problem. If someone steals it from one device, it may work on all the others. Each computer should have a unique admin password. Microsoft’s built-in Windows LAPS tool can create and rotate these passwords automatically.

How to remove administrator access safely

Don’t remove every administrator account at once. Someone still needs a working way to manage and repair each computer.

1. Find out who has administrator access

Review the local Administrators group on every Windows computer and the admin users on every Mac. Include old accounts, shared accounts, vendor accounts, and accounts created during the original setup.

2. Confirm why each person has it

Ask what tasks require admin access. Every account that keeps the permission should have a clear business reason. Needing to update one application now and then doesn’t justify permanent access.

3. Make sure IT has a working admin account

Before removing anyone’s permissions, confirm your IT team or provider can sign in with a protected admin account. Test it on each device so you don’t lock yourself out of your own computers.

4. Test important software

Check the programs each employee needs for their job. Confirm they open, update, and work correctly under a standard account. Review any application that fails before you remove admin access permanently.

5. Switch the employee to a standard account

Once you’ve checked the computer, remove the employee from the local Administrators group or change their account type. Have them sign out and back in so the new permissions take effect.

6. Tell staff how to request an install

Give employees one place to go when they need software installed or a setting changed. Explain what to include, such as the program name, why they need it, and the official download page.

7. Review access when roles change

Check administrator access whenever an employee changes jobs, takes on new responsibilities, or leaves. Include it in your regular access reviews too.

If you’re a Tri-Cities business and aren’t sure who has administrator access on your computers, get in touch with Pacific Edge Technology. We’ll review every account and remove unneeded admin rights without disrupting your team.

Administrator Access FAQs

Can a standard user install software?

It depends on the software. Programs that install only inside the employee’s user profile may not need admin approval. Software that changes protected system files, installs drivers, or adds background services usually requires administrator credentials.

Will removing administrator access stop employees from working?

Normal business applications should keep working. Test specialized and older applications before making the change on every computer.

Does removing administrator access stop malware?

It limits what many harmful programs can change, but it doesn’t prevent every attack. You still need supported software, security updates, endpoint protection, email security, MFA, and tested backups.

Should the business owner keep administrator access?

Use a standard account for everyday work. If you need admin rights for an approved task, use a separate account and protect its password.

Is local administrator access the same as Microsoft 365 administrator access?

No. Local administrator access controls one computer. Microsoft 365 admin roles can control cloud users, email, files, security settings, and other parts of your Microsoft environment. Limit and review both.

Sources and further reading

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Why Your Employees Shouldn’t Have Administrator Access to Their Computers