Cybersecurity Foundations (Grades 6–8) · lesson 26 of 48 · 10 min
Why Account Management Is a Security Skill
One of the most common ways malware causes damage is by running with the same privileges as the user who is logged in. If you are logged in as an administrator and malware infects your computer, that malware has administrator access — it can install software, disable antivirus, modify system files, and create new accounts.
This is why the principle of least privilege — giving users and processes only the minimum access they need — is one of the most important security principles. Windows implements this through its account type system.
By the end of this lesson you will be able to describe the three Windows account types, explain UAC and why it matters, apply the principle of least privilege to account management, and configure basic account security settings.
The admin account problem
Studies show that over 90% of critical Windows vulnerabilities would be mitigated if users ran as standard users instead of administrators. Yet most home users run as administrators by default. This single change — switching to a standard user account for daily use — would eliminate the majority of malware damage on home computers.
Windows Account Types
Windows uses different account types with different levels of access. Understanding these helps you apply the principle of least privilege — using the minimum access needed for each task.
Administrator account — full control over the system. Can install software, change system settings, create and delete accounts. Should only be used when needed.
Standard user account — limited access. Can use installed software and change personal settings but cannot install system-wide software or change security settings. Use this for daily activities.
Guest account — very limited, temporary access. No password required. Should be disabled on most systems.
Microsoft account vs. local account: A Microsoft account syncs settings across devices and enables cloud features. A local account is stored only on the device — more private but fewer features.
Best practice: Create a standard user account for daily use. Only use an administrator account when installing software or changing system settings. This limits the damage malware can do — malware running as a standard user has limited system access.
UAC and Account Security
UAC (User Account Control) — a Windows security feature that prompts for confirmation (or administrator credentials) when a program tries to make changes to the system. The “Do you want to allow this app to make changes?” dialog.
UAC prevents malware from silently making system changes. Never click “Yes” on a UAC prompt you did not initiate.
Securing Windows accounts:
Use a strong password or PIN for your account. Enable Windows Hello (fingerprint or face recognition) if available. Set the screen to lock after inactivity. Disable the built-in Administrator account (it is disabled by default — keep it that way).
Local Security Policy — advanced settings for password complexity, account lockout (locks account after failed attempts), and audit logging.
Why not use admin daily?
If you use an administrator account daily and malware infects your computer, it runs with administrator privileges — it can install software, disable antivirus, and modify system files. A standard user account limits malware to user-level access.
Key Terms
Real-World Case Studies
Case 1: The Target Breach — Least Privilege Failure
The 2013 Target data breach that exposed 40 million credit cards started with a phishing email to an HVAC contractor. That contractor had remote access to Target’s network — but with far more privileges than needed for HVAC billing. If least privilege had been applied, the contractor’s access would have been limited to billing systems only. Instead, attackers used those credentials to reach payment systems. The lesson: least privilege must be applied to every account, including third-party vendors.
Case 2: UAC Bypass Malware
Malware authors have developed numerous techniques to bypass UAC — exploiting trusted Windows processes to elevate privileges without triggering the UAC prompt. This is why running as a standard user (not just relying on UAC) is important. When malware runs as a standard user, even a successful UAC bypass gives it less to work with. Defence in depth: standard user account + UAC + antivirus + firewall.
Activity — Account Type Sorting
Which account type should you use?
- Browsing the web and checking email
- standard
Daily tasks should be done as a standard user. This limits what malware can do if your computer is infected.
- Installing a new application
- admin
Installing software requires administrator privileges to modify system files. Use admin only for this.
- Writing a school essay in Word
- standard
Document editing does not require system access. Standard user is appropriate.
- Changing system security settings
- admin
System settings changes require administrator access. Elevate only when needed.
- Playing a game or watching a video
- standard
Entertainment activities do not require elevated privileges.
- Updating device drivers
- admin
Driver updates modify system files and require administrator privileges.
Knowledge Check
Windows Users and Accounts
For daily computer use, you should use:
- An administrator account
- A standard user account
- A guest account
- A Microsoft account only
- Answer: A standard user account
Standard user accounts limit what malware can do if your computer is infected. Use administrator only when needed. UAC (User Account Control) prompts appear when:
- You log in
- A program tries to make system changes
- You connect to Wi-Fi
- Your password expires
- Answer: A program tries to make system changes
UAC asks “Do you want to allow this app to make changes?” — preventing silent system modifications by malware. If you see a UAC prompt you did not initiate, you should:
- Click Yes to allow it
- Click No and investigate
- Ignore it
- Restart your computer
- Answer: Click No and investigate
An unexpected UAC prompt may indicate malware trying to install itself. Click No and run a malware scan. The guest account should be:
- Used for daily browsing
- Disabled on most systems
- Given administrator access
- Used for software installation
- Answer: Disabled on most systems
The guest account requires no password and has no accountability. Disable it unless you specifically need it for temporary visitors.
Malware running under a standard user account has the same power as malware running under an administrator account.
Answer: False
Malware inherits the permissions of the account it runs under. Standard user malware cannot modify system files or disable antivirus.
Over 90% of critical Windows vulnerabilities would be mitigated if users:
- Used stronger passwords
- Ran as standard users instead of administrators
- Installed more antivirus programs
- Disabled Windows Update
- Answer: Ran as standard users instead of administrators
Running as a standard user is one of the single most impactful security changes a Windows user can make.
Previous lesson: HTTPS and TLS
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Windows Defender and updates