16 October 2026

Why Employees Shouldn't Have Admin Access on Work Computers

Photo by Anna Shvets on Pexels

It usually starts with one request. Someone needs to install a printer driver, update a piece of specialist software, or change a setting a standard account won't let them touch. Giving them administrator access solves the immediate problem.

What often doesn't happen afterwards is taking it away again.

From that point on, the same account can install anything else, approve changes that would normally need a word with IT first, and make changes that affect the whole machine, not just their own files. If they install the wrong thing, or someone else gets hold of their login, whoever's in control inherits all of that too.

For everyday work, a standard account covers almost everything most people need. Administrator access should be kept for the specific tasks that genuinely require it, not left switched on because it was easier the first time round.

What administrator access actually controls

An administrator has more control over a device than a standard user does.

On Windows, membership of the local Administrators group gives "Full Control permissions on the device", which is why Microsoft's own guidance on local accounts recommends limiting how many people are in it. Depending on how a machine is set up, an administrator can typically:

• Install and remove software
• Add printer drivers and other hardware
• Create, change or remove other user accounts
• Change system-wide settings
• Change permissions on files and folders belonging to other people
• Install background services that keep running without anyone noticing

Macs work the same way in principle. Apple's own account guidance says an administrator "can add and manage other users, install apps, and change settings", while a standard account "can install apps and change their own settings, but can't add other users or change other users' settings." Apple also advises against sharing administrator logins between people, or setting a Mac to sign in automatically as an administrator, since that hands full access to anyone who simply restarts it.

It's worth being clear about what this covers. Local administrator access controls one device. It's a separate thing entirely from being an administrator in Microsoft 365 or Google Workspace, which can touch email, shared files and user accounts across the whole business. Someone can have full admin rights on their own laptop without being anywhere near your cloud admin settings, and the two need reviewing separately. If it's been a while since anyone looked at the second one, these five Microsoft 365 settings are worth a second look.

Why leaving it switched on is a risk

Software normally runs with whatever permissions belong to the person who launched it. That's the part that matters here.

If a program asks for administrator approval and the signed-in account can grant it, that program can potentially install system components, change security settings, or reach files belonging to other users on the same machine. That's exactly the position someone's in when they open a convincing fake installer, click through a malicious attachment, or download something from a site that looked legitimate enough. They think they're approving a routine update. What they're actually doing is handing that program the same level of access they have.

Windows uses User Account Control to ask permission before most administrative changes go through. Someone signed in as an administrator can approve their own request. A standard user has to enter separate administrator credentials, which gives whoever holds those credentials, usually IT, a chance to notice the request and decide whether it's genuine before it happens.

This is also the reasoning behind the principle of least privilege that runs through most current UK guidance on the subject. The National Cyber Security Centre's guidance on preventing lateral movement recommends keeping a clear line between everyday accounts and privileged administrator accounts, and, where an organisation is large enough to need it, tiering admin access so a single compromised account doesn't carry full run of the network. The same logic applies at a much smaller scale on an individual laptop: if the account someone uses for email and browsing can't approve system changes on its own, a compromised login is a much smaller problem than it would otherwise be.

What a standard account can still do

Removing admin rights doesn't stop anyone doing their actual job. A standard account is enough for:

• Reading and sending email
• Browsing the web
• Working in Microsoft 365 or Google Workspace
• Using approved business applications
• Joining video calls
• Printing to an already-installed printer
• Opening and saving files
• Changing personal settings that don't affect anyone else

Some software installs fine under a standard account because it only writes to that person's own profile. Other programs need administrator approval because they add drivers, background services, or files in parts of the system a standard account can't reach. Needing one update installed isn't a reason to hand someone permanent admin rights. It's a reason for IT to install it, push it out remotely, or grant access to whichever specific folder the program actually needs.

Older line-of-business software sometimes still expects administrator rights to run at all. That's worth testing properly before changing anyone's account type, since the fix is usually to reconfigure the application or the folder permissions it needs, not to leave the account elevated indefinitely.

Getting software installed without leaving admin rights switched on

None of this means staff have to wait days for anything installed. It just moves who approves it.

An IT team or provider can install most software remotely, which also gives them a chance to confirm it's actually come from the software vendor and that the version being installed is a supported one. Businesses with managed devices can push approved applications and updates out to everyone without a single person needing to run an installer by hand. For a one-off request, someone can simply ask IT, who enter the credentials themselves rather than handing the password over. And for the handful of roles that genuinely need to install or test software as part of the job, a separate administrator account, switched on only when it's needed and used for nothing else, does the job without leaving standing access in place all year round.

Who should actually have it

Administrator access should sit with whoever's work genuinely depends on it: internal IT staff, your IT provider, or a specific technical employee responsible for a particular system. Everyone else, including the business owner, can run day to day work perfectly well from a standard account and switch to an administrator login only for the odd task that needs it.

Your IT provider should keep a working administrator account of their own so they can support every device, with that password properly protected rather than shared around. It's also worth checking that admin passwords aren't identical across every machine in the business. If one gets exposed, an identical password lets it be reused everywhere else, whereas a unique password per device, managed through a password solution rather than kept in someone's head, contains the damage to a single machine.

This is also one of the five technical controls behind Cyber Essentials, the UK Government-backed certification scheme: user access sits alongside update management, firewalls, secure configuration and malware protection as one of the areas it specifically assesses. Getting standing admin rights under control is usually one of the more straightforward parts of preparing for it.

Removing admin rights safely

Don't switch everyone over in one go. Someone still needs a reliable way to manage and fix each device while this is happening.

1. Check who actually has it. Go through the local Administrators group on every Windows machine and the administrator users on every Mac, including old accounts, shared logins and anything set up by a supplier during the original install.
2. Confirm there's a working admin account for IT first. Test that your team or provider can sign in and manage each device before anyone else's access changes, so the business is never accidentally locked out of its own equipment.
3. Test the software people rely on. Open the applications each person actually uses day to day under a standard account and confirm they still work properly. Anything that fails needs sorting before that person's access changes, not after.
4. Change the account and have them sign back in. Once a device has been checked, move the account to standard and have the person sign out and back in so the change takes effect.
5. Give people somewhere to ask. One place to request an installation or a settings change, with enough detail (what it is, why it's needed, where it's from) for whoever's handling it to act quickly.

Access reviews shouldn't stop there. Admin rights tend to get missed when someone changes role or leaves, so it's worth folding a check of who has them into whatever regular review the business already does.