Do you use an Admin account or Standard User Account?

[show-Zi]

There were also times when I was temporarily using SUA. If I knew the password with administrator privileges, it wasn't a problem. I think this controversy will be divided depending on whether the administrator account can be used together. It can be a source of stress if only others know the administrator's password.

 

[blackice]

There were also times when I was temporarily using SUA. If I knew the password with administrator privileges, it wasn't a problem. I think this controversy will be divided depending on whether the administrator account can be used together. It can be a source of stress if only others know the administrator's password.

My issue is some programs won’t run, or run improperly on startup with SUA. Also, some programs don’t always work as expected on SUA. If programmers designed for SUA I’d be so happy!

 

[yuanyasmine]

If this is your computer and you are responsible for maintaining it then there is no good reason to set your user account to standard. You are the administrator, you need an administrator account.

At least one user needs to be an administrator. Otherwise you would need to reboot into safe mode and log into the special administrators account in order to do any common maintenance tasks. A royal PIA.

The standard account should be reserved for young children or less-than-trustworthy users of your computer, people you fear my make system changes "for fun", or who just can not help but click on that dancing monkey.

Even then it is far better to teach and train them. They will need to behave as administrators themselves one day.

 

[Andy Ful]

There are several good reasons to use SUA, for everyone.
Anyway, there is nothing wrong if one uses only Admin account in daily work. There is nothing wrong too, if one smoke cigarettes, drink alcohol, and do not eat healthily.
But sometimes, it is better to eat healthily and do not take several pills to mitigate bowel obstruction.

 

[DDE_Server]

Some clarifications about SUA.

1. One can install applications when logged on SUA (without Admin password), if they do not require Admin rights.
2. Some web browsers can be installed on SUA even if they initially ask for Admin rights. If the user chooses NO, then the browser can continue installation in %UserProfile% without Admin rights.
3. The SUA is much safer when we talk about exploiting the programs or Windows features. This follows from the fact that processes running with Admin rights must do it on another account (a particular Admin account) and cannot run on SUA.
4. One can install applications that require Admin rights when logged on SUA, but after writing the Admin password in UAC prompt, the installation is redirected to the Admin account. This can cause some issues because the application custom settings, made by the user during installation, will be written in the Admin user profile and not in the SUA user profile. After launching the application from SUA, the application cannot access these settings and the application has to be configured again.
5. When the malware is running on Admin account with standard rigths, this is also the same account for many processes with Admin rights. Sharing the same account by the processes with different privileges is like sharing the same room with people who can be invected by COVID-19.
6. If the malware is running on SUA (necessarily with standard rights), then there is no processes with Admin rights on SUA. High privileged processes are running on other account(s) (Admin type). This is similar to the situation when the infected patient is isolated in a single room from others.
7. That is why there are many UAC bypasses on Admin account, but not on SUA.

Thanks Andyful very useful brief.bookmarked for future read.

 

[Andy Ful]

Almost three years ago I wrote the thread about SUA:

User Account like a Castle

What is User Account with UAC? It is like a castle. Is the castle a security? It was in the medieval ages. What is Standard User Account (SUA) with UAC? It is a castle in the medieval ages. What is Administrator Account (AA) with UAC? What a stupid question. It is a castle in the 21st...

malwaretips.com

I put there a simple UAC bypass that worked on Admin account with UAC set to MAX (Always notify). And let's guess, does it work on the fresh updated Windows 10 1909?

 

[SeriousHoax]

This is me without admin account

 

[enaph]

I use Admin account for years already without any issues and I don't see any single reason to stop doing that.
Of course I know what I am doing and I can mitigate the risk of infection by using common sense and whitelisting.

 

[Andy Ful]

I use Admin account for years already without any issues and I don't see any single reason to stop doing that.
Of course I know what I am doing and I can mitigate the risk of infection by using common sense and whitelisting.

I know many people who are smoking cigarettes, drinking alcohol, drive sometimes without seat belts. Most of them live happily until they die.
If one feels unhappy with SUA, then probably he/she should not use it. There are many ways to be safe & happy.

Edit.
I do not use SUA (it is not especially convenient for a software developer).

 

[enaph]

If one feels unhappy with SUA, then probably he/she should not use it. There are many ways to be safe & happy.

It's not the matter of being unhappy.
I am just trying to utilise the most secure yet effortless setup

 

[mkoundo]

Used AA since win98 days. I posted my security config here on MT a few years ago (i think 2017) and @oldskool recommended SUA, which I did. My system is fairly static and tbh, I don't miss using an AA. I think SUA with H_C goes a long way to mitigating security holes.

 

[Howard1975]

I'm a new member here at MalwareTips, but not new with computers. I have been using computers since the late 1980s and early 1990's, starting with MS-DOS and Windows 3.1, then later Win95, 98, Win2K, XP, Vista, 7 and now Win10. And I started using Linux in the late 1990's.

Back in the old days, you basically had to use admin account, to get anything done. Honestly I have always used the admin account when using Windows, it is a habit from my 30 years with computers. I still prefer to be the admin when using Windows. I'm often doing tasks that need to be run from the admin account.

I know using SUA for doing everyday tasks has improved a lot, from the way things were 20 years ago with Windows 2000.

When I use Linux, I normally use the standard user account, and only use the root (admin) to install and upgrade software, and admin the computer. Or use sudo on those distros that use sudo.


EDIT: I do plan to use a standard user account more often, for playing games for instance, and basic office tasks. And use admin account, when it is warranted.

 

[ncage]

I do to many things that require admin privileges (i'm a developer) so running SUA is to big of a pain. I leave UAC so i know when something is trying to elevate that shouldn't.

 

[ForgottenSeer 97327]

@blackice

I am also running Standard . May be you could revice this poll and see whether the SUA use has risen in the last two years.

Thx

 

[Victor M]

I go a step beyond SUA. My admin account has a logon script that takes it offline. Only when i install software that needs to do setup downloads do I go online with my admin account. And when the admin account logs out, the log out script brings back the internet.

 

[WhiteMouse]

I haven't found any difference between SUA and Admin beside a prompt for password. I could change the policy to require a password for admin account to prevent accidentally press the "yes" button.

 

[piquiteco]

I have always used a standard account since windows XP, at the time I used "SuRun" because in windows XP, it was bad to use the administrative account, after Microsoft introduced UAC in windows vista, 7,8, 8.1 and 10. I just use the standard account. I don't do nothing in standard account, like elevate administrative privileges, install programs, not even change the date or time, to avoid the privilege escalation, when I need to install or update something, I log out and go into the Admin account and do what I need, it takes 5 seconds, using this way since then I never had problems, then I discovered the magnificent tool of @Andy Ful Hard_Configurator now the account has become even more restricted.

 

[blackice]

@blackice

I am also running Standard . May be you could revice this poll and see whether the SUA use has risen in the last two years.

Thx

Haha, my guess is it's up on MalwareTips, but I don't run an SUA anymore (so one less). I am a low risk user and it caused me too many headaches. If just 2 or 3 things could run at launch with it then I might consider going back.

 

[Guilhermesene]

I have always used a standard account since windows XP, at the time I used "SuRun" because in windows XP, it was bad to use the administrative account, after Microsoft introduced UAC in windows vista, 7,8, 8.1 and 10. I just use the standard account. I don't do nothing in standard account, like elevate administrative privileges, install programs, not even change the date or time, to avoid the privilege escalation, when I need to install or update something, I log out and go into the Admin account and do what I need, it takes 5 seconds, using this way since then I never had problems, then I discovered the magnificent tool of @Andy Ful Hard_Configurator now the account has become even more restricted.

Nice your report, I want to do this. One question: do you apply the @Andy Ful tools when you are logged in as an administrator account and the settings are applied to the entire system or do you need to apply them to each user of the system?

I ask this because I like to use Configure Defender settings in MAX (that's when I use Windows Defender) I just don't know if I have to apply this to each user or just the administrator account.

Thanks in advance for answering me

 

[Andy Ful]

I ask this because I like to use Configure Defender settings in MAX (that's when I use Windows Defender) I just don't know if I have to apply this to each user or just the administrator account.

All my tools (except DocumentsAntiExploit tool) are system-wide.