Local admin rights
Also known as: local administrator rights, admin rights, local admin privileges, administrator privileges
Local admin rights give a user full control over a computer: installing or removing software, changing security settings, and accessing all files.
Many small businesses give every employee admin rights for convenience, but malware that runs under an admin account can disable protections, install more malicious tools, and spread more easily. Removing admin rights from everyday accounts is one of the most effective, low-cost security improvements. While it can create friction when staff need new software, IT can provide approved ways to install it.
Local admin rights, explained at three levels
At home
Admin rights are like having keys to every room and the fuse box in an apartment building. A tenant with only their own key can live normally, but someone holding the master set can rewire anything. On a computer, an administrator can install software and change security settings, while a standard user can only use what's already there, which limits damage from mistakes or malware.
At work
Local admin rights let a user install software, change security settings and modify system files on a work computer. When everyday accounts have them, any malware a user accidentally runs gets the same power, and can switch off antivirus or install more tools. Businesses remove these rights from daily accounts and give IT a separate way to install approved software, cutting risk at little cost.
At home
Windows separates standard accounts from administrator accounts. A standard account can run programs and change its own settings, but cannot install software for everyone, change security settings or touch system files. When something needs admin power, Windows shows a User Account Control prompt asking for permission or an admin password. Malware running under a standard account inherits those same limits, so it cannot easily disable antivirus or bury itself deep in the system.
At work
Removing local admin rights is one of the most effective controls available, since much malware and many attacker tools need elevation. Organizations replace those rights with standard accounts, approved software deployed through Intune or a company portal, and privilege management tools such as Intune Endpoint Privilege Management, which elevate specific approved apps without full admin rights. IT staff use separate admin accounts or LAPS passwords for occasional tasks.
At home
Some programs ask for administrator rights even for simple jobs, such as a PDF converter or game mod. Saying yes gives that program, and anything bundled with it, full control of your computer, including the ability to install drivers and change security settings. Legitimate apps occasionally need it, but many do not. In my view, if a free program insists on admin rights for something simple, be suspicious, and that is a good moment to look for an alternative.
At work
Remove local admin rights in phases, starting with a pilot group, and collect elevation requests to find which apps genuinely need it. Provide a self-service catalogue so users can install approved software without tickets, and use endpoint privilege management for rule-based elevation with logging. Keep IT staff admin activity on separate accounts from email and browsing. Track exceptions with expiry dates, since temporary admin rights tend to become permanent.
Real-world examples
At home
Nadia set up her kids' laptop with standard accounts. When one tried to install a sketchy game download, Windows asked for her admin password and she declined.
At work
Carlos manages IT for a Montreal design agency. After removing admin rights and adding a company portal for approved apps, malware incidents dropped sharply.
How it compares
| feature | Admin account | Standard account |
|---|---|---|
| Install software | Yes | Only approved apps or with approval |
| Change security settings | Yes | No |
| Malware impact | Severe | Limited |
| Best for | IT tasks only | Daily work |
Use standard accounts daily and admin accounts only when needed.
For analysts
When removing admin rights, I'd gather a list of software staff actually need first. Good preparation turns a resented change into a smooth one.
History & origin
Early personal computers gave every user full control. Windows NT in 1993 introduced separate administrator and standard user accounts, but most home and small office users kept running as administrators. Windows Vista's User Account Control in 2007, widely disliked at first, prompted users before admin actions. Security firms have repeatedly reported that a large share of critical Windows vulnerabilities could be mitigated by removing admin rights, though exact figures vary by report. Microsoft previewed a Windows 11 feature called Administrator protection in 2024, giving admins temporary elevated rights only when needed. In my view, letting everyone be an administrator is the IT equivalent of giving every employee the master key.