Why Your Employees Shouldn’t Have Administrator Access to Their Computers

It can be tempting to give employees administrator access to their work computers. After all, if someone needs to install a printer, update a piece of software or change a setting, giving them the necessary permissions means they can simply get on with it.

It might not seem like a big deal, but having administrator rights gives a user considerably more control over their computer that they need. If they accidentally install something malicious, download a fake software update or fall victim to an attack, those same permissions could potentially be used to make much more serious changes to the device.

For everyday work, employees should generally use a standard user account. Administrator access should be limited to people and tasks that genuinely require it.

The UK's National Cyber Security Centre (NCSC) specifically recommends creating a separate standard user account for day-to-day work and reserving administrator access for when it is actually needed.

What does administrator access actually allow?

An administrator has a much greater level of control over a computer than a standard user.

On a Windows PC, someone with administrator privileges may be able to:

Install and remove software
Install drivers for printers and other hardware
Change important system settings
Create, change or remove user accounts
Change permissions on files and folders
Install services that run in the background
Install unlicensed or illegal software

Microsoft's guidance on local accounts recommends limiting the number of users in the local Administrators group because members have extensive control over the device.

The same principle applies to Macs. Administrator accounts have additional permissions that allow them to make changes affecting the computer and other users. Apple's guidance on Mac administrator accounts recommends limiting the number of administrative users and using a standard account when administrator rights aren't required.

It's also important to understand that local administrator access is not the same thing as Microsoft 365 administrator access.

An employee might have administrator rights on their laptop without having any administrative access to your Microsoft 365 environment. These permissions should be considered separately and reviewed independently.

Why is permanent administrator access a security risk?

The biggest issue is that software normally runs with the permissions of the user who launches it.

Imagine an employee receives an email asking them to install an "important security update". The website looks convincing and the software appears legitimate.

They download and run the installer.

If they're using a standard account, Windows may ask for administrator credentials before allowing the software to make certain changes to the computer. That gives IT an opportunity to check what's being installed and where it came from.

If the employee is already an administrator, they may simply be able to approve the request themselves.

That doesn't mean administrator access automatically makes a computer insecure, and it certainly doesn't mean that every piece of software installed by an administrator is dangerous. The problem is that a compromised administrator account gives an attacker considerably more options.

Microsoft's explanation of User Account Control explains how Windows uses User Account Control to help prevent unauthorised changes and why standard user accounts provide an additional layer of protection.

The NCSC's guidance for small organisations also recommends using standard user accounts for everyday activities and limiting administrator access to when it is required.

For a broader explanation of the risks associated with privileged accounts, the NCSC also recommends that administrator accounts are protected carefully and only given to people who genuinely need them. NCSC guidance on protecting administrator accounts is a useful reference for businesses reviewing their access controls.

If you're looking at this as part of a wider review of your business IT security, WYSIWYG's Managed IT Support services include device management, user account security, cyber security monitoring and protection.

What can employees still do with a standard account?

Quite a lot.

A standard account should allow an employee to carry out the vast majority of their normal work, including:

Sending and receiving email
Browsing the web
Using Microsoft 365
Working with business applications
Joining Teams meetings
Accessing company files
Printing to an already-installed printer
Opening and saving documents
Changing their own personal settings

The things they may not be able to do are actions that require changes to the wider computer, such as installing certain applications, drivers or system components.

And that's actually a useful distinction.

If an employee needs something that requires administrator privileges, it gives your IT team the opportunity to check what is being installed before allowing it onto the company's computers.

"But my employees need to install software!"

This is one of the most common reasons businesses give employees administrator access.

But needing to install software occasionally doesn't necessarily mean someone needs permanent administrator rights.

There are several ways of dealing with software requests.

Let IT install approved software

Your IT provider or internal IT team can install the application for the employee.

This also provides an opportunity to check that the software has come from a legitimate source and that the version being installed is appropriate for the business.

Use managed software deployment

For businesses with centrally managed computers, approved applications and updates can often be deployed without requiring employees to install them manually.

This can make it easier to keep software consistent and up to date across the organisation.

Approve individual requests

If an employee needs a particular application, they can request it from IT.

IT can check the request and provide the necessary administrator credentials without giving the employee permanent administrator access.

Use a separate administrator account

Some employees genuinely need increased privileges because of the nature of their role.

In those cases, a separate administrator account can be used.

The employee should continue to use their standard account for email, web browsing and normal day-to-day work, only using the administrator account when they actually need the additional permissions.

This is also the approach recommended by the NCSC: normal work should be carried out using a normal user account, with a separate administrator account used only for administrative activities. NCSC guidance on protecting administrator accounts explains this approach in more detail.

Who actually needs administrator access?

There isn't one answer that applies to every business, but administrator access should generally be limited to people who have a genuine business need for it.

That might include:

Internal IT staff
Your IT support provider
Approved technical employees
Employees responsible for particular specialist systems

Being the business owner doesn't automatically mean you need administrator access to every computer either.

If you're using your laptop to work on emails, documents, accounts and Microsoft 365 every day, a standard account is usually the better option. If you occasionally need administrator access for a particular task, that can be dealt with separately.

The principle is simple:

Give people the access they need to do their job — not more access than they need.

This is often referred to as the principle of least privilege.

The NCSC describes this principle as giving users the minimum level of access needed to perform their role and recommends taking access away when it is no longer required. NCSC guidance on secure system administration provides further information.

Don't forget about administrator passwords

There is another important consideration for businesses using local administrator accounts.

Avoid using the same administrator password on every computer.

If that password is compromised on one machine, it could potentially give an attacker a route into other devices.

Microsoft's guidance on local accounts explains the importance of protecting local administrator accounts and limiting their use.

Modern device-management tools can also help businesses manage local administrator accounts and their credentials centrally.

This is one of the areas where having properly managed business IT can make a significant difference.

Our Managed IT Support service includes device management, security and proactive monitoring designed to help businesses keep their IT systems properly managed.

How can you remove administrator access safely?

If your business currently gives most employees administrator rights, don't simply remove everybody from the Administrators group overnight.

You should first understand why those permissions are there and make sure that removing them won't disrupt someone's ability to work.

A sensible process would be:

Find out who has administrator access

Review the accounts on your business computers and identify which employees have administrator privileges.

Don't forget old accounts, shared accounts and accounts created when computers were originally set up.

Understand why they have it

For each person, ask:

What do they actually need administrator access to do?

If there isn't a clear business reason, they may not need the permission.

Make sure IT has a working administrator account

Before removing administrator access from employees, make sure there is still a secure administrator account available to manage each computer.

You don't want to discover that nobody can administer a machine after you've removed the permissions!

Test important applications

Some older or specialist applications may have been designed with the expectation that users have elevated permissions.

Test the software employees rely on before making the change across the business.

If something doesn't work correctly, investigate why rather than automatically giving the user administrator access again.

Change unnecessary administrator accounts to standard accounts

Once you've confirmed that everything is working and there is a suitable administrator account available, remove unnecessary users from the local Administrators group.

Tell employees what to do when they need something installed

Make the process simple.

Employees should know who to contact if they need new software, a printer installed or a setting changed.

It doesn't have to be complicated — a support ticket, email or IT support request may be all that's required.

Review access regularly

Administrator access shouldn't be something that's granted once and then forgotten.

Review it when:

Someone changes role
Their responsibilities change
A new computer is issued
Someone leaves the business
A security incident occurs
You carry out a wider IT security review

Regular access reviews help prevent privilege creep, where people gradually accumulate permissions they no longer need.

The NCSC also recommends reviewing accounts and removing access when people no longer need it.

What if an employee says they need administrator access?

It's worth asking why.

Sometimes there is a perfectly legitimate reason. They may use specialist software, develop applications, manage equipment or perform technical tasks that genuinely require elevated permissions.

The answer doesn't necessarily have to be "no".

Instead, consider whether there is a safer way to provide the access they need.

Could IT install the software for them? Could they have a separate administrator account? Could the permission be provided temporarily? Could the application be configured differently?

The aim isn't to make employees' lives more difficult.

It's to make sure that everyday activities don't automatically come with unnecessary administrative privileges.

Frequently Asked Questions

Can a standard user install software?

It depends on the software.

Some applications can be installed without administrator rights, while software that needs to change protected system files, install drivers or add system-wide services will normally require elevated permissions.

That's where having an IT support process can help. Rather than giving everyone administrator access, employees can request the software they need and have it installed safely.

Will removing administrator access stop employees from working?

It shouldn't stop normal business activities.

However, specialist and older applications should be tested before making the change across all company computers. If an application doesn't work without administrator rights, investigate the reason rather than simply restoring permanent administrator access.

Does removing administrator access stop malware?

No.

It is one layer of protection, not a complete cyber security solution.

Businesses should also consider software and operating system updates, endpoint protection, email security, multi-factor authentication, secure backups and staff awareness.

The NCSC's guidance for small organisations recommends taking a layered approach to cyber security rather than relying on a single measure.

We also provides user training and security awareness support, helping businesses make sure their staff understand the technology and security risks they face.

Should the business owner have administrator access?

Not necessarily.

Business owners should generally use a standard account for everyday work too. If administrator access is required for a particular task, a separate administrator account can be used where appropriate.

Is local administrator access the same as Microsoft 365 administrator access?

No.

Local administrator access relates to the individual computer.

Microsoft 365 administrator roles can provide access to areas such as users, email, security settings and cloud services.

Both types of privileged access should be carefully controlled.

If your business uses Microsoft 365 and you're not sure whether your current setup is making the most of the security features available, we can help you review and manage your Microsoft 365 environment.

A small change that can make a big difference

Administrator access is useful when you need it. The problem is when everyone has it all the time.

For many small businesses, moving employees to standard user accounts is a relatively straightforward improvement that can reduce the potential impact of malware, accidental changes and compromised accounts.

If you're not sure who currently has administrator access on your business computers or you're worried that removing it could cause problems, it's worth getting your IT provider to review the situation before making changes.

We can help you understand how your computers and user accounts are currently configured and identify sensible improvements without making things unnecessarily complicated.

If you'd like to talk through your IT setup, you can also book a free Ask Us Anything session with WYSIWYG and ask us about administrator access, security or anything else you're unsure about.

If you'd like us to take a look at your business IT setup, get in touch with the WYSIWYG Computers team.