Are Windows limited user accounts effective?
Hi everyone.
Leo Notenboom here for AskLeo.com. Here's a question.
"How effective is using a limited user account to surf the net?
I've read that if you get infected
with a virus or Trojan, et cetera, the amount of damage caused can be
dramatically reduced if you were logged in with a limited account.
Also, if I set up such an extra account
for surfing, do you have to run antivirus updates and do scans on both the accounts?
Or does one antivirus anti spyware scan cover all the accounts on the computer?"
Yeah. Limited user accounts,
also known as standard accounts as opposed to administrator accounts,
are very effective at reducing the potential impact of malware.
Unfortunately, they're also effective at reducing your own impact.
It could be very difficult sometimes to get some of the things you want to get
done if you're not an administrator capable account.
And that little turn of phrase there
administrator capable kind of sort of alludes to something else.
For all intents and purposes,
you're already running as a limited user, even if you don't think so.
The concept behind limited user accounts, or LUA, as it's sometimes referred to,
is that you don't need every privilege in the world in order to do most day
to day things: surfing the web, sending email.
None of that should require special permissions, and rarely does.
So if you don't need those permissions, why have them?
If those permissions,
those extra permissions you don't need could be abused by malware.
That's the idea.
Running as a limited user, you don't have those permissions.
So if for some reason you get malware on your machine and it tries to do
something, it can't, or you'll at least get notified or
something will prevent it all from happening because you don't have
the permissions to do the things that the malware wants to do.
Great.
How do you set up a limited user account?
Let me show you real quick.
We're doing this in Windows Ten.
We're going to go ahead and hit the Settings app.
I'm going to search for users and we'll add editor remove other users.
Now you can see that in addition to the account that I'm signed in as,
I have two additional accounts, backup admin and this Leon account that I
used as an example for setting up a backup admin.
Now let's add a limited user account.
We'll add someone to this PC.
I'm going to Leo.
This be a Microsoft account, so I'm going to use
the email address
of someone else's Microsoft account.
That's how they will sign in to this machine once this account is set up.
And that's it.
Not quite that's almost it.
You can see here that the account has been added.
Nobody's logged in as that account yet, but the account has been added.
We'll click on it and we'll change account type.
The trick here is that chances are you've
already set up a standard user a limited user account.
But just in case, make sure to verify that that's what this says.
If you change it to administrator, then they will be administrator capable.
If you leave it as standard user, then they will not.
If they then sign into this machine, they will have their own files,
their own folders, and their limited ability to do things on this machine.
That's really all there is to it.
So I'll be blunt.
I don't do this.
I don't use limited user accounts.
There are two reasons.
One is it can be really, really frustrating.
The problem is not with standard accounts or Lua accounts themselves.
The problem is with software that I'm running or have installed or whatever,
especially software that's been around for a very long time,
often makes the assumption that it has all the power in the world.
It makes the assumption that whether or
not it needs to, it can do things as the administrator.
It makes the assumption that it's not limited and it can be frustrating.
There are also scenarios where it's a very
valid thing that, yes, a program I just downloaded I want to install.
Well, limited users probably shouldn't be installing things.
Again, Lua gets in the way from my day to day.
Yeah, I do install things from time to time.
It's kind of the nature of some
of the things that I do, so it keeps getting in the way.
The other side of it, though, is that, in all honesty,
you already are kind of a limited user,
even if your account is labeled as administrator.
Because one of the very common questions I get is something just asked me to be
the administrator, but I am the administrator.
Well, no, you're not.
The account you set up when you set up
Windows initially is labeled an administrator account.
What I keep referring to that as is an Administrator capable account,
which means most of the time you're actually running with limited privileges.
It's not until you try to do something
that the system notices, hey, you're not running with administrative privileges.
That's when the User Access Control or User Account Control dialog comes up
and says, hey, are you sure you want to do this?
This requires administrative privileges.
It's a confirmation.
The primary difference between an Administrator capable account
and a limited user account is whether or not the UAC box asks for a password.
If you are an Administrator capable
account, then it's simply an okay cancel type of affair.
It's warning you that you're about to do
something that requires administrator capabilities.
But since you are an Administrator capable account, you just click okay and move on.
In some cases,
you may need to intentionally run a program as administrator, but again,
even there, at worst, you'll get the UAC prompt with an okay
to confirm you want to do what you're trying to do and you move on.
If you are a limited user account, if you're a standard user,
you still get the UAC prompt but it asks you for a password.
You have to prove that you have the right to do what it is you're about to do.
If you set up standard accounts for say your kids,
then you don't give them the password that they would need to be the administrator.
That way they can't install random stuff and they won't randomly or accidentally
allow malware to go past the point of being able to install itself as well.
So there are scenarios where limited accounts work.
But realize that if you're the only user
on the machine and you're using the account that was created at Windows
setup, you're running limited most of the time anyway.
It really is just the convenience factor
of the UAC prompt where all you need to do is click.
Okay now about anti malware and security software.
There's great news here if you've got it installed properly which typically means
you've either installed it as part of Windows.
In other words you're using Microsoft Defender built into Windows or
you're installing some other security software which you probably had to be
administrator to do anyway, then the system is protected.
It protects everything on the system,
not just your specific files so you don't need to do anything on a per user basis.
All you need to do is make sure that you've got your security software
installed and running and keeping itself up to date and you'll be fine homes.
That helps.
For Updates For comments for related links and more, visit AskLeo.com/2846
I'm Leo Notenboom and this is Ask Leo.com. Thanks for watching.