How Computers Work · How an Operating System Works · Lesson 2 of 5

Users and Admin Rights

Standard and administrator accounts, and the box that asks first.

Two kinds of accounts

A user account is your own sign-in on the computer. It has your name, your password and your own folders. Several people can share one computer, each with their own account.

Windows has two main kinds of accounts:

• A standard account can use apps, browse the web, and work with its own files. It can't make big changes that affect everyone.
• An administrator account, or admin, can change anything. It can install programs for all users, change security settings, and add or remove other accounts.

Big changes go through a gatekeeper called User Account Control, or UAC. When a program tries to make a system change, the screen dims and a box asks: "Do you want to allow this app to make changes to your device?"

• If you are an admin, you just click Yes or No.
• If you are a standard user, the box asks for an admin's password or PIN. Without it, the change does not happen.

That dimmed screen is on purpose. Other programs can't click Yes for you while it is showing. Only a person at the keyboard can answer.

Read the box before you answer. It shows the program's name and who made it. If you didn't just start something, click No.

On a Mac, it is similar. A window asks for an admin's name and password before big changes.

On the practice computer, sign in as the standard user and try to install a program. See what the UAC box asks for.

Why everyday use should be standard

Here is the key idea. Any program you run gets the same powers as the account running it.

Say you open a bad email attachment by mistake. Say you are signed in as an admin. The bad program can try to install itself deep in the system. With one click on Yes, it can change settings for everyone.

If you are signed in as a standard user, it hits a wall. To dig into the system, it needs the admin password, and you don't type it. The damage usually stays inside your own account. That is much easier to clean up.

So a common safe setup looks like this:

• One admin account with a strong password, used only for installs and settings.
• A standard account for each person's daily use, including the owner.

When a standard user needs to install something, the UAC box simply asks for the admin password. It costs a few seconds and blocks a lot of trouble.

To change an account's type on Windows 11, sign in as an admin. Go to Settings > Accounts > Other users. Pick the account, choose Change account type, then pick Standard User or Administrator.

Always keep at least one admin account whose password you know. Without one, nobody can install apps or fix settings.

On a Mac, go to System Settings > Users & Groups. Click the info button next to a user and turn "Allow this user to administer this computer" on or off.