Administrator access often starts with a simple request. An employee needs to install a printer, update specialist software, or change a setting on their computer.
Giving them administrator access solves the immediate problem. The issue is that those permissions often remain in place long after the task is finished.
From that point on, the employee can approve software installations and make system changes without involving IT. If they install the wrong application, or if their account is compromised, those same permissions can be used to make significant changes to the device.
For day-to-day work, employees should use standard user accounts. Administrator access should be reserved for tasks that genuinely require it.
What Administrator Access Allows Someone to Do
An administrator has far more control over a computer than a standard user.
On Windows, members of the local Administrators group have full control over that device. Depending on how the computer is configured, an administrator can typically:
Install and remove software
Add drivers for printers and other hardware
Create, change, and remove user accounts
Change system settings
Modify permissions on files and folders
Install background services
Adjust certain security settings
Mac computers also distinguish between standard users and administrators. Administrative users can install software, manage accounts, and make system-wide changes.
Local administrator access applies only to the computer itself. It is separate from Microsoft 365 administrator roles, Google Workspace administration, network administration, or server administration.
An employee may have administrator rights on their laptop without having any administrative privileges in Microsoft 365, and vice versa. Both should be managed and reviewed separately.
Why Permanent Administrator Access Increases Risk
Software launched by an employee normally runs with the permissions available to that employee.
When someone has administrator rights, approving an installation may allow software to:
Install system components
Change operating system settings
Modify files belonging to other users
Install services that continue running in the background
This becomes a problem when someone downloads a fake installer, opens a malicious attachment, or installs software from an untrusted source. The user may believe they are approving a legitimate update while actually giving harmful software control over the device.
Windows uses User Account Control (UAC) to prompt for approval before many administrative changes. If an employee is already an administrator, they can approve those changes themselves. A standard user typically needs credentials from an authorised administrator.
Using standard accounts reduces the number of people who can make system-wide changes without review. It ensures IT has an opportunity to verify the software, its source, and the permissions it requires before installation.
Restricting local administrator access is a recognised cybersecurity best practice and forms part of several security frameworks designed to reduce business risk.
Standard Accounts Are Suitable for Everyday Work
A standard account is suitable for most daily business activities, including:
Reading and sending email
Using a web browser
Working in Microsoft 365 or Google Workspace
Using approved business applications
Joining online meetings
Printing to installed printers
Opening and saving files
Changing personal settings that do not affect other users
Some software can be installed without administrator rights because it only affects the current user. Other applications require administrator approval because they install drivers, services, or files in protected areas of the operating system.
An employee should not receive permanent administrator access simply because a program needs updating. IT can install the update, deploy it remotely, or use a separate administrator account when elevated permissions are required.
Older business applications occasionally expect users to have administrator rights. These applications should be tested before permissions are changed. In many cases, the issue can be resolved by updating the software, modifying its configuration, or granting access to specific folders rather than granting full administrator rights.
Managing Software Installations Without Permanent Administrator Access
Employees can still receive software installations and updates without keeping administrator privileges.
Let IT Install Approved Software
Your IT provider or internal IT team can install software remotely. This also allows them to verify that the software comes from a legitimate source and is an approved version.
Use Managed Software Deployment
Organisations with managed devices can deploy approved applications and updates automatically. This removes the need for employees to run installers themselves and helps ensure consistency across the business.
Approve Individual Requests
Employees can submit requests when software requires administrator approval. IT can review the request and complete the installation without sharing administrator credentials.
Provide Temporary Administrator Access
Some roles occasionally require elevated permissions for testing or specialist tasks. In these cases, administrator access can be granted temporarily and removed once the work is complete.
Use Separate Administrator Accounts
Employees who genuinely need administrator rights should use a separate administrative account rather than working daily with elevated privileges.
Email, web browsing, and normal business activities should always be performed using a standard account.
Who Should Have Administrator Access?
Administrator access should be limited to people who need it to perform their job.
This may include:
Internal IT staff
Your managed IT provider
Approved technical employees
Specialists responsible for particular business systems
Business owners should also use standard accounts for everyday work. Company ownership does not require permanent administrator access to every computer.
Your IT provider should maintain a secure administrator account for support purposes. Passwords should be protected and never shared with employees.
Using the same local administrator password across every computer creates unnecessary risk. If the password is compromised on one device, it may provide access to others. Each device should have a unique administrator password or be managed through a system that controls administrator credentials securely.
How to Remove Administrator Access Safely
Do not remove all administrator accounts at once. Someone must always retain the ability to support, manage, and recover each device.
1. Identify Existing Administrator Accounts
Review administrator accounts on all business computers, including:
Employee accounts
Shared accounts
Supplier or vendor accounts
Legacy accounts
Accounts created during device setup
2. Confirm the Business Need
For each account, determine why administrator access was granted and whether that requirement still exists.
Occasional software updates do not justify permanent administrative access.
3. Verify IT Access
Before removing permissions, confirm that your IT team or provider has a working administrator account on every device.
Test access to ensure the business cannot become locked out of its own systems.
4. Test Business Applications
Check that all critical software functions correctly when employees use standard accounts.
If an application fails, investigate the root cause before removing administrator rights permanently.
5. Change Employees to Standard Users
Remove employees from the local Administrator group or change their account type to a standard user account.
Users should sign out and back in again to ensure the changes take effect.
6. Create a Clear Request Process
Give employees a defined process for requesting software installations or system changes.
Requests should include:
Software name
Business justification
Official vendor website
Required deadline
7. Review Access Regularly
Administrator rights should be reviewed whenever:
An employee changes role
New responsibilities are assigned
An employee leaves the business
Regular access reviews are conducted
Frequently Asked Questions
Can a Standard User Install Software?
Sometimes. Applications that install only for the current user may not require administrator approval. Software that installs drivers, services, or system-wide components usually does.
Will Removing Administrator Access Stop Employees From Working?
In most cases, no. Standard business applications should continue to function normally. Specialist and legacy applications should be tested beforehand.
Does Removing Administrator Access Prevent Malware?
No, but it does reduce the damage many forms of malware can cause. It should be part of a wider security strategy that includes security updates, endpoint protection, email security, multi-factor authentication, and reliable backups.
Should Business Owners Keep Administrator Access?
Business owners should use standard user accounts for daily work. Administrative tasks should be performed using a separate administrator account when necessary.
Is Local Administrator Access the Same as Microsoft 365 Administrator Access?
No.
Local administrator access applies to an individual computer. Microsoft 365 administrator roles can control users, email, files, security settings, and other cloud services across the organisation.
Both types of access should be restricted and reviewed regularly.
Final Thoughts
If you're unsure who has administrator access within your organisation, or whether those permissions are still required, it's worth carrying out a review.
Many businesses discover that administrator rights were granted years ago for a one-off requirement and never removed. Reducing unnecessary administrator access is one of the simplest and most effective ways to improve security without affecting employees' day-to-day work.