Local administrator rights — the single change that matters most

In most small companies everyone works on an account with local administrator rights. Not out of negligence — it was simply easier when the machines were set up, and nobody reversed it afterwards.

The consequence is straightforward: whatever a user runs, runs with that user’s privileges. A clicked attachment on an ordinary account damages that one person’s files. The same attachment on an account with administrator rights can disable protection, install itself permanently, reach other accounts on the machine and move on across the network.

That is the whole difference, and it costs nothing.

Why this beats buying something

Antivirus detects what it knows. Privileges work differently — they limit the consequences regardless of whether anything was detected. Malware nobody has seen before still cannot install a driver or shut down an agent if the account has no right to.

So if one security change is going to happen in a company, make it this one. The next licence is usually a conversation for much later than it is held.

Where the resistance comes from

Three arguments come up every time, and all three are solvable:

“I won’t be able to install anything.” True — and that is the point. The question is how often something genuinely needs installing. In a typical office the answer is a few times a year, not a few times a week. If it turns out otherwise, that is interesting information in itself.

“Program X needs administrator rights to run.” Sometimes true. Usually it needs them only to install, and badly written software may want write access to its own directory — which can be solved with permissions on that one folder, without handing over rights to the whole machine.

“The director has to have them.” That is the worst idea of the lot. The account of whoever runs the company receives the most mail from unknown senders and is the most frequent target of targeted phishing. If anyone is to be without administrator rights, it is that person.

How to carry it out

Do not start with everyone at once. The change is noticeable, and introduced overnight it guarantees a wave of tickets in the same week.

Step 1: establish the facts

Check how many accounts actually hold the rights. It usually turns out to be more than anyone assumed — including accounts belonging to people who no longer work there.

Step 2: a separate administrative account for IT

Before you take rights away from users, make sure a separate account for administrative work exists and that you have access to it. Removing rights without preparing one ends in having to rescue the machine.

That account is not for everyday work. You do not read mail on it and you do not browse the web.

Step 3: one person as a trial, then a department

Start with somebody friendly and technical. Over a week, collect the list of things that stopped working. It is usually shorter than expected and contains two or three programs to be handled separately.

Then one department, then the rest.

Step 4: a route to elevation

There has to be a predictable way for a user to get what they genuinely need. It can be a ticket to you, it can be a tool for controlled elevation. What matters is that the waiting time is known — if the answer arrives after three days, people will find a workaround, and workarounds are worse than the problem.

Worth closing at the same time

Removing rights is a good moment for three things that need doing anyway:

• Accounts left by departed employees — they surface during the review and there are usually several.
• Local accounts sharing one password across all machines — if those exist, one compromised machine means all of them. Windows has a built-in mechanism for randomising local account passwords and it is worth switching on.
• A shared “office” or “reception” account — you cannot establish who did what, and the password is known to everyone who ever worked there.

What to expect

The first two weeks: more tickets, mostly about installations and small permissions. Then quiet.

The real cost is a few hours of work spread over a month plus some patience. In return you get a situation where a clicked attachment is one person’s problem rather than an event for the whole company. No purchase in that price range produces a comparable shift.