How to Set Up a Standard User Account (or Limited Account) on Windows Vista and Windows 7 for Daily Use

One of my visitors heard about how surfing and working on Windows using a standard user account (or in his words, "limited account") was safer than just using the default administrator account, and asked me how he could go about converting his current admin account into a standard user account. This article shows you how you can do this.

What is a Standard User Account? Is it Safer to Surf the Internet (etc) with it?

If you have set up your own computer (as opposed to getting an office computer set up for you by a system administrator), chances are that you are running your programs under something known as an administrator account. On a Windows system, be it Windows Vista or Windows 7 (or in fact, even Windows
XP, 2000 and NT), an administrator account is the most powerful user account. When you are logged into such an account, you can install programs, change or delete important system files, and in fact do anything you want on the system that a user is allowed to do. You'll be able to do this because any program you run on your computer will run with those all-powerful administrator rights.
By the same token, if you inadvertently run a virus or some other malware (ie, harmful program), that malicious software can also modify your system in any way it wishes to, since it too will run with admin rights.
For this reason, some security pundits recommend that you do your normal day-to-day work in a standard user account, and not an administrator account. A standard user account, previously called a limited user account in Windows XP, restricts what you can access on your computer. Programs that run in a standard user account, in theory, are not able to do things like modify the Windows system files. People running in standard user accounts will also not be able to install programs into the main "c:\Program Files" or "c:\Program Files (x86)" folders (in theory), although they can still install it into their own private folders. (I say "in theory" because, like all computer programs, Windows has bugs. If a bug is serious enough, it can be exploited to let malware do things they should not be able to.)
This does not mean that if you operate from a standard user or limited account, you will be immune from harmful programs. Far from it. Viruses, spyware and other malware can still infect your account. They can install themselves into your private folders (just like any other ordinary program can) and set themselves up to run every time you log into your account. They can still steal data from your documents (etc), since those will usually reside in your private folders. In other words, it can do everything that you can do as a standard user, including access your files.
So why then, you may ask, should you bother to set up and use a standard user account? The general thinking among those security experts is that even though you can still be infected and your data harmed or stolen from a standard user account, the number of possible ways malware can infect your system is fewer in such an account than in an administrator account. Barring bugs in Windows itself, theoretically, the malware cannot do things it traditionally does, like modify your Windows system files, unless you explicitly give it permission to do so when Windows prompts you with its User Account Control (UAC) dialog box. This hopefully protects you from some of the things that can harm your system. Of course, if you are one of those who blindly clicks "Yes" or "OK" to every dialog box that appears, then nothing is ever going to protect you.
In any case, even after you switch to a standard user account from an administrator account, you should continue to protect your system the usual way, such as by installing and running an antivirus program.

One thing to note before you rush to convert your account to a standard user account is that not all programs work correctly if run from such an account. Some old programs assume that they are always run in an administrator account, and are not able to function correctly otherwise. Having said that, in my admittedly limited experience, the programs that are certified to work in Windows Vista and Windows 7 appear to have a better chance of working fine when run from a standard user account.

How to Move Your Settings from an Administrator Account to a Standard User Account

When you first set up your system, Windows will deposit you into an administrator account, since you will otherwise not be able to install anything. Hence this article starts from the premise that you already have one account set up: your administrator account.
The trick to setting up a standard user account the easy way, preserving all the configuration settings you've made so far, is to simply convert your existing administrator account into a standard user account. However, before you do that, you'll need to create a new administrator account first. Otherwise, after you convert your admin account to a limited account, you'll no longer be able to install new programs or do any other tasks that require an admin account.

Why Convert Your Existing Administrator Account? Why Not Just Create a New Standard User Account?

There's nothing to stop you from simply creating a new standard user account. In fact, if you are setting up your computer for multiple users, that's probably what you'll want to do. However, if you're the only user on the computer, and you've already spent a lot of time configuring your current user account so that it behaves exactly the way you like, setting up a new standard user account means that you have to configure that account from scratch all over again. For most people, this is a great hassle.
You're probably wondering what's the difference between that and the method I mention below. The thing to remember is that your new admin account is only set up so that you can do things like install new programs. You're not going to be using it on a daily basis, so you probably don't really need to customise ("customize" in US English) it heavily, if at all. In fact, you will probably rarely, if ever, log into it after you finish the things described below. Even for those few times you need to run things that need administrator rights, such as program installers, you don't need to log into that account. You can work directly from your standard user account, and invoke that particular program with administrator rights. Don't worry. Instructions for this will be given later in this article.
As such, to avoid the hassle of customising everything from scratch again, it may be simpler to just create a new admin account to use in those rare times when you need to install things (and not bother to customise it), and convert your existing (already customised) account into a standard user account for daily use.

1. Create a New Administrator's Account

   Make sure you're logged into your administrator account, which you probably are, since you're reading this article to find out how to create some other type of account. I'm merely saying this for completeness sake. If you have only one user account on your computer, it's probably already the administrator account.
   
   1. Click the Start menu (the button with the picture of the Windows logo). Type "user accounts". If this brings up multiple entries at the top of the Start menu, select the item that says "User Accounts". If you hover your mouse pointer over that item, it should have a tool tip saying something like "Changes user account settings and passwords for people who share this computer". Click that item to start the Windows User Accounts window.
   2. Click the link that says "Manage another account". If you use Vista, and Windows pops up a dialog box entitled "User Account Control", click the "Continue" button. A new screen will appear, with a top heading that says "Choose the account you would like to change".
   3. Click the link that says "Create a new account". (It should be somewhere near the bottom of the window.)
   4. The window should now have a header that says "Name the account and choose an account type". Type the name of the new account in the space provided. It can be any name, such as "christopher heng admin" or whatever.
   5. Under the field where you just typed your name, click the radio box that says "Administrator". This is important, otherwise you'll end up creating a "Standard user" account. Remember, you want to create an administrator account to replace the current one that you're using, and then convert your current one to a standard user account.
   6. Click the "Create Account" button.
   7. You will be returned to the screen entitled "Choose the account you would like to change". You should be able to see the new account you created there. Click it.
   8. A new screen with the title "Make changes to [your account name]'s account", where "[your account name]" is whatever name you used earlier. Click the link "Create a password" to set a password.
      

      Pros and Cons of Setting a Password for the Administrator Account on a Computer Only Accessible to You

      If your computer is only accessible to you, and it doesn't really contain anything of importance, you may be tempted not to create a password even for your administrator account. Before you decide, here are some things to consider:
      

      Advantages of Setting a Password

      It adds an additional hurdle for you when a program (such as a setup program for a new program that you want to install) asks for permission to modify your system files. No, you didn't read this wrongly; this is actually an advantage.
      Explanation: When a program needs to modify your system files or settings, and you're not an administrator, Windows will throw up a "User Account Control" (UAC) window, asking for your permission before it allows the program to continue. If you have set a password for your admin account, you'll have to enter your admin account password before clicking the "Yes" or "OK" button for that dialog box.
      This is good because it forces you to stop and consider what's happening. All of us who have been using computers for some time have probably become accustomed to dialog boxes popping up and asking us inane questions like "Are you sure you want to quit?", "Are you sure you want to continue?", etc. As such, many of us click on "OK" and "Yes" buttons automatically, out of habit, maybe even without consciously registering that such a dialog box may have appeared in a context where it shouldn't.
      If you set a password for the admin account, and a virus or some other malware tries to infect your computer by modifying the system files, the UAC window will not let you simply click the "Yes" button, since you're currently not logged in as the administrator. You'll have to stop and enter your password before Windows will allow the program to continue. Hopefully, this additional hurdle will slow you down enough so that you realise, "Hey, wait a minute! I'm not installing a program at the moment. Why does this program need permission to access my protected system files?"
      

      Disadvantages of Setting a Password

      The problem with setting a password for your rarely used admin account is that it's extremely easy to forget what that password is. It's even easier to forget the admin account password than it is to forget your password to, say, your email account. After all, you access your email account practically every day (and for some people, multiple times per day), probably forcing you to type that password repeatedly until you remember it by heart.
      This will not be the case for your admin account. If you rarely install programs or new versions of existing programs, chances are that you'll not need that password for long periods of time. This means that when you finally need to use that password, you may have already forgotten what it is.
      (Of course, one way around this is note your password down somewhere.)
   9. If you want to password-protect your admin account, enter the password into the fields provided. You'll have to do it twice. If you like, you can also enter a password hint. When you've finished, click the "Create password" button.
      (Note: if you've changed your mind about setting a password, click the "Cancel" button instead of the "Create password" button.)

2. Check to Make Sure You Can Log Into Your New Administrator Account

   Before you continue, you should log out of your existing user account, and try to log into the new administrator account. Windows will take some time to set up the new account, so you may have to wait a while when logging in for the first time.
   Some people also set a different background (wallpaper) for their admin account from their standard user account. This way, should they ever need to log into the admin account, they won't forget where they are. Otherwise if everything looks the same, it's very easy to forget to return to your standard user account before surfing the Internet or doing some other non-admin task.

3. Convert Your Existing Account into a Standard User Account

   Now that you have a new administrator account to fall back to, you can convert your original admin account into a standard user account.
   
   1. Log out of your new administrator account, and log into your original account (the one that you want to convert to a standard user account).
   2. Once again, click the Start menu and type "user accounts" and start up the "User Accounts" program.
   3. Click the "Change your account type" link on the page.
   4. Click the "Standard user" radio button to enable it.
   5. Click the "Change Account Type" button.

How to Run Programs with Administrator Rights from a Standard User Account

After setting up your account as mentioned above, you should work from your standard user account for all the things you do normally.
There are, however, a few occasions where you may need to run programs with administrator rights. You don't have to log into your admin account for that.
If you're running a program installer, chances are that the program installer will automatically ask Windows to elevate its rights to an administrator level. This will cause Windows to issue a User Account Control dialog box. If you have set a password for your admin account, you will have to enter your password before Windows will give the installer administrator rights.
Should you ever need to run a program as administrator, and Windows does not automatically issue the User Account Control dialog box, right click that program's executable file (or even its shortcut icon). In the context menu that pops up, click the "Run as administrator" menu item. The UAC dialog box will pop up and you will need to enter the admin password (assuming you set one) before continuing.

Conclusion

That's it. As you can see, the process of converting to a standard user account is actually very simple. Remember however that a limited account is not the panacea to your security problems. It only provides an additional hurdle to a limited subset of malware. You'll still need to protect your system in other ways, such as by installing antimalware software, etc.

Please Do Not Reprint This Article

This article is copyrighted. Please do not reproduce this article in whole or part, in any form, without obtaining my written permission