Should you use an administrator account every day on Windows 11?

Windows 11 hands you an administrator account the moment setup finishes. It has to: the first account on a PC needs to be able to install things. And then nobody ever changes it. A parent, the other parent and a twelve-year-old all sign in as administrators for the next six years, and every program any of them opens starts out with the right to change anything on the machine.

It's the setting I change most often on a home PC. On my £10 a month home device security plan it's written into the baseline as "an everyday account without administrator rights". Here's why, what it costs you in daily annoyance, and how to do it yourself if you'd rather not pay me.

What an administrator account lets through

An administrator can install software for every user, switch off Microsoft Defender, change the firewall, edit the registry and open other people's files. A standard account can't do any of that unless someone types an administrator's password.

You'd think the User Account Control box covers the gap. That's the "Do you want to allow this app to make changes to your device?" prompt. On an administrator account it only wants a click on Yes, and people click Yes. They've clicked it two hundred times for printer drivers and game updates, so the two hundred and first time, when it's a fake PDF reader from a search ad, gets the same click. On a standard account the same box asks for a password the person at the keyboard may not even know. That pause is the whole point.

The numbers behind it

BeyondTrust publishes a count of Microsoft's vulnerabilities every year. Its 2026 report, out in April, found 1,273 for 2025. Of those, 509 were elevation of privilege bugs, 40% of the total and the same share as the year before. An elevation of privilege bug is a flaw whose whole job is to turn a program running with ordinary rights into one with full control of the PC.

Older editions of the same report asked a sharper question: how many critical Microsoft flaws would have been blunted just by the user not being an administrator? For 2019 the answer was 77%. For 2020, the last year I can find that figure published, it was 56%. It swings a lot from one year to the next, depending on which products had a bad year and how BeyondTrust counted, so I wouldn't hang an argument on any single figure. The direction never changes.

Malware that lands on a standard account is still a problem. It can read your documents and whatever your browser keeps, which is why I wrote about passwords saved in Chrome and Edge. What it usually can't do without a second bug is turn off your antivirus, install itself for every user, or dig in somewhere a reboot won't shift it. Smaller mess.

What it costs you

Some friction, and I won't pretend otherwise. You'll type a password when you install a program, update a driver or change certain system settings. Plenty of apps from the Microsoft Store install without asking at all. A few older programs, and some games with anti-cheat software, want administrator rights every time they update, and those will nag.

Kids lose the ability to install whatever a YouTuber told them to. Most parents count that as a feature.

Nothing else moves. You keep the same account, the same desktop, the same OneDrive folder and the same bookmarks, because the only thing that changes is one label on the account saying what it's allowed to do to the rest of the machine.

How to switch on Windows 11, in about five minutes

Order matters here. Make the spare administrator first, then demote yourself. Do it the other way round and you can end up with nobody on the PC able to install anything.

1. Open Settings, go to Accounts, then Other users.
2. Next to Add other user, click Add account. Choose I don't have this person's sign-in information, then Add a user without a Microsoft account.
3. Call it something dull like PCadmin and give it a long password. Write the password down and keep it away from the PC.
4. Back on Other users, open the new account, click Change account type, pick Administrator and click OK.
5. Sign out, sign in once as PCadmin so Windows finishes setting it up, then come back to the same page and change your everyday account to Standard User.
6. Sign back in as yourself. Everything is where you left it.

From then on, when Windows wants to change something, it asks for the PCadmin name and password. Nobody uses that account day to day. That one habit is what makes the whole thing work.

If your everyday account is a Microsoft account it stays one, so OneDrive and your saved recovery keys are untouched. While you're signed in as PCadmin, it's worth checking where your BitLocker recovery key is, because the command for that needs administrator rights anyway.

Microsoft's own answer: Administrator protection

Microsoft has been building a middle way, called Administrator protection. It reached Windows 11 24H2 and 25H2 with the optional August 2026 update, KB5120998, on Home and Pro alike. You stay an administrator, but Windows runs you without admin rights until something needs them. Then it asks you to confirm with Windows Hello (usually your PIN), creates a short-lived admin token inside a separate hidden account, and throws the token away when that program closes. No silent elevations at all.

It's a good design. I'm still not relying on it for home PCs yet, for two reasons.

First, it's off by default. Microsoft only switched it on by default for organisations that use its security baselines, from the October 2026 update. Second, the easy way to turn it on, a toggle under Account protection in the Windows Security app, is still a preview for Windows Insiders. The other routes are Group Policy and Intune, and Windows 11 Home has neither. Microsoft's own list of known issues is long too: app settings that don't carry over to the elevated session, network drives that elevated programs can't see.

When that toggle reaches everyone I'll look at it again for people on the plan. Until then a standard account does most of the same job, on every edition, today.

Common questions

Will a standard account stop viruses?
No. It narrows what a virus can do once it's in. You still need updates installing, Defender switched on and some care about what you click.

I'm the only person who uses this PC. Do I still need a second account?
Yes. Windows needs somebody with admin rights to install things. The spare account is that somebody, and you only ever type its password when Windows asks.

What if I forget the PCadmin password?
Then nobody can install software or change system settings until it's reset, and that's a fiddly job. Keep it written down next to your BitLocker key, not on the PC.

Does this work on Windows 10?
The same idea works, and the steps are close. But Windows 10 stopped getting free security updates in October 2025, so a standard account there is a plaster, not a fix. I wrote about what to do with PCs that can't run Windows 11.

If you'd rather I did it, the home device security plan sets this up with you on day one, alongside updates, Defender, the firewall and disk encryption. Then each month I check that nothing has been switched off, including an everyday account quietly turned back into an administrator. It's £10 a month per PC with no minimum term. For a business with a handful of laptops, the same check is part of a Windows security audit.