Windows 10/11 Administrative Accounts

How To:  Build a Windows 10 / Windows 11 Administrative Account - demote your normal account to a "loser account."

The gist is this:  For your day-to-day work, your local user account should not be a Windows Administrative User Account.  Demote your normal login to a "Standard" user.  Have a second Login account as "ADMINI" -- giving it full rights.  

This article replaces an older Windows 7 article:  Secure PCs from Offspring.
A more succinct version of these steps can be found here:
Widows 11 Tuneup
https://keyliner.blogspot.com/2021/11/windows-11-tuning.html


Synopsis:
Steps to convert your normal, daily Windows 10/11 User Account from an "Administrative" account to a "Standard Account" (a non-administrative, non-elevated, "loser" account).  This helps prevent malware from installing, and protects the machine from inadvertent changes from other family members.

Use administrative credentials for system-wide changes and let your "loser" account handle day-to-day work.  This follows best practice at Microsoft, at most corporations, and schools.  I use this technique on all of my computers, even on my own account.  

Viruses present themselves by enticing the victim with a game or some other program of interest.  If the user is an administrator, that install sails through.  Most people see the nag screen and click "Allow," without thinking.   You've probably done this yourself.  In other words, you have given the virus permission to install.

But when the account does not have permissions, Windows intercepts the install, asking for an official blessing -- one where you have to stop and type a password.  Slow this down with a deliberate password.

The Setup

Follow these steps to enable an Administrative account.  Basically, create a second, backdoor administrative account, then using that account, demote your normal account to a "Standard" user.  A new Administrator account must be built before converting your existing account to a "loser" account.

1. Build an Administrator Account

Using your current (presumably) Administrator Account (using your normal login-credentials):

a.  Windows 11: Click Start, Type "Settings" (the Gear icon)
     Select left-nav, "Accounts"
     In "Other Users", "Add account"

Click for larger view

Windows 10:  In the Start Menu's Search box, search for "Control Panel"

Open "User Accounts"

Select "Manage another Account"

b.  Click "Add a user account".  Windows 10 illustrated:

c.  at the "How will this person sign-in"

    ! Do not enter an email address

Instead, click "Sign in without a Microsoft account (not recommended)"
or in Windows 11, "I don't have this person's sign-in information."

   

Then, "Add a user without a Microsoft Account"
If this works, and looks as-described, jump to step d (password)

 

Update: As of 2020.02, Microsoft hid the "Sign in without a Microsoft Account" 
option, depending on which Microsoft Update has been applied. 

If this option is not available, do one of the following to disconnect from the Internet while this account is being built:

* If a laptop on Wireless, switch to Airplane Mode before building this account

* If Desktop on Wired, unplug the Ethernet cable

* If Desktop on Wireless, click lower-right Wireless icon and disable Wireless.  Then retry these steps.

At the second prompt, again select "Local Account".  (Microsoft really wants a login account, synchronized with the Internet, but in this case a local account is all that is needed.)

d.  Build the Account Name and Set the password.

Use account name "Admini" 
(This is a recommended name, Microsoft no longer allows "admin" or "administrator')

Set the password, *
Set the password hint(s)

*If this is your personal machine, consider setting the password to the same password used for your normal login - one less thing to remember.  It goes without saying, don't forget this password. 

Once the account is built, and password set, change the account's "type", next.

f.   Click the new Admini / Administrator account.

 Click "Change the account type"

 Change the Account Type from "Standard" user to an "Administrator User"

Important: You must change Admini to an administrative account before doing the next step.

2.  Logout from your normal account, then Login as Administrator:

a.  Logout steps: 

Windows 10:  Click Start, (Shutdown: submenu); Select "Log off" or right-mouse-click the profile-picture icon halfway up the start menu.

Windows 11:  Click Start and on the bottom-edge, right-click your profile picture, "Sign Out".  Illustrated:

b. Log back in as Admin

Windows 10 and 11: 
At the banner / desktop login screen, notice two icons in the lower-left.  Find your existing user and the new Admini account.

Click the Admini account icon to login.

This builds the Administrator's profile.  This takes a few moments.
The screen and icons will look different; Do not worry. This account will only be used for installing software and system changes.

3.  Change the original (child's) account:

While logged in as Administrator,

a.  Windows 10: Click Start, type/search, "USERS",

find "Manage another account", then "Change User Account Settings"

Windows 11: Click Start, type/search, "USERS", selecting "Add, edit, or remove other users."  In the center of the screen, see your user account.

b.  Select your original account  (this is your account's name (or your child's account, etc.)

c. "Change the account type";

Change from Administrator to a Standard user. 
Close and save the changes.

In other words, demote yourself to a "loser" account.

d.  Logout as Admin. 
(Start, Shutdown-sub-menu, Log off)

e.  Re-login as your normal account.

You are done.

Results:
You will be running as a "Standard" (non-administrative, non-elevated account).  All programs will run normally, but system changes and installing software requires credentials -- commonly called a UAC prompt.  This helps keep the bad guys out.

Using Elevated Credentials:
To test in Windows 11:  Right-mouse-click the Start Menu, choose "Device Manager". 
Note the prompt, "you are logged in as a standard user.... read only". 

To run Device Manager as administrator, search "Control Panel".  Right-mouse-click "Device Manager", and "Run as Administrator".   Similarly, administrative credentials are now required to install software or viruses.  All new installs prompt for UAC permission. 

To run a Setup.exe as an elevated user, shift-right-mouse-click the .exe, and "Run as Administrator".

Whenever you see a UAC prompt, asking for an account-name and password, hesitate.  Decide if the install is safe.  Ask yourself this question:  Did I request this action or did it magically or unexpectedly appear?

Wise people do not tell the children or non-computer-literate parents the administrative password. 

Windows system updates will run as-before (and will install on their normal schedule with their normal system account).  Applications, such as Acrobat Reader, will prompt for permission before updating.  This is a good thing. 

Closing note:
Having a backdoor administrative account -- even if it is different than your own personal administrative account, is useful as a side-door into the system should your normal profile become corrupted. 

-end

Related Articles:
Corrupted Profile?  See this article for hints on how to build a new administrator login from a damaged profile:
https://keyliner.blogspot.com/2020/06/windows-10-command-prompt-black.html

Raspberry Pi-Hole - A DNS SinkHole for security