Windows Security · Accounts & Sign-In Security · Lesson 3 of 5

Admin Rights in Depth

Why malware wants admin power, and how to keep it out of reach.

Why malware wants admin

In How Computers Work, you met standard and administrator accounts. You also met the User Account Control box, which asks before big changes. Now let's see why this matters so much for security.

Least privilege is a basic security rule. It means every person and program gets only the power it needs, and no more. A cashier can open the till, but not the bank vault.

On a computer, admin power is the vault key. With it, a program can:

• Install software for every user, including hidden programs that start each time the PC turns on.
• Change or turn off security settings, like Microsoft Defender or the firewall.
• Install drivers. These are small programs that run deep inside Windows and talk to hardware.
• Read and change other users' files, and Windows' own system files.

That is why malware, which means harmful software, wants admin rights. Without them, it is mostly stuck inside one user's space. It can still harm that user, for example by reading their files. But it has a much harder time digging into Windows, hiding from security tools or reaching other accounts.

Malware usually can't grab admin power by force. It has to ask, and the asking is the UAC box. So many attacks are really tricks to make you click Yes. A fake update, a cracked game, or a video player a site says you need all try this.

Before you approve a UAC box, read it:

• Verified publisher shows the company that signed the program. A name you expect, like Microsoft or the app's maker, is a good sign.
• Publisher: Unknown means no one vouches for it. Be very careful.
• Ask yourself: did I just start this? A box you didn't expect is a reason to say No.

UAC levels and a separate admin

User Account Control has four levels. To see them, open Start, type UAC and choose Change User Account Control settings. A slider shows, from top to bottom:

1. Always notify. Asks before apps make changes, and before you change Windows settings.
2. Notify me only when apps try to make changes. This is the default.
3. The same as level 2, but without dimming the desktop.
4. Never notify. No prompts at all.

The dimmed screen matters. It is called the secure desktop. While it shows, other programs can't click Yes for you or draw a fake box on top. Level 3 skips it, so a sneaky program has an easier job. Level 4 turns the warning off completely, and Microsoft does not recommend it.

Keep the default, or move the slider up to Always notify. Never move it down to stop the prompts. If a program, a website or a caller tells you to lower UAC, treat it as a red flag.

The strongest everyday setup is a separate admin account:

• Your daily account is a standard user.
• One admin account has its own strong password. You only use it when a UAC box asks.

Now a UAC box can't be approved with one click. You must type the admin password, which gives you a moment to think. Malware running in your standard account can't approve it alone.

Before you switch your own account to standard, create the admin account first. Then sign in to it once to test it. Always keep at least one admin account whose password you know.

On a Mac, the same idea works. Set up one admin user and a standard daily user in System Settings, under Users & Groups.