Why your employees shouldn’t have admin rights on their computers.

Admin rights almost never get granted as a policy decision. They get granted as a favor. Someone needed a printer driver in 2023, the fastest fix was making them a local administrator, and the permission has been sitting there ever since, long after anyone remembers why.

That leftover permission is the problem. An employee with local admin can install anything, approve anything, and change settings that would otherwise require IT. Which means any malware that gets a foothold through that account can do the same.

What admin access actually unlocks

On a Windows machine, a local administrator can install and remove software, load drivers, create accounts, change system and security settings, and set up services that keep running in the background. Macs draw the same line between standard and administrator accounts. Both Microsoft and Apple tell businesses the same thing: keep the administrator list short, and work from a standard account unless a task genuinely needs more.

One distinction worth keeping straight: local admin on a laptop is not the same thing as admin in Microsoft 365 or Google Workspace. One controls a single computer; the other can control email, files, and user accounts for the whole company. Review both, separately.

Why the standing permission is the risk

Software runs with the permissions of whoever launched it. When that person is a standard user, a fake installer or malicious attachment hits a wall: the operating system asks for an administrator’s credentials, which the user doesn’t have, and IT gets a chance to look at the request. When that person is an administrator, they can click “Yes” on their own, and most people approving what looks like a routine update will.

That one click is the difference between malware confined to a user profile and malware that can dig into the system, disable protections, and persist. It’s why security agencies like CISA and their counterparts abroad consistently put restricting admin privileges near the top of their baseline recommendations.

Standard accounts don’t break daily work

Email, browsers, Microsoft 365 or Google Workspace, approved business apps, video calls, printing to installed printers, opening and saving files: all of it works fine from a standard account. In most 25–150-person companies, the honest count of people who need standing admin rights is zero to two, and those two should be using a separate admin account, not their daily one.

The real friction point is usually one legacy application that expects admin rights. Test those before you flip the switch. Most can be fixed with a configuration change or targeted folder permissions rather than a blanket grant.

How software gets installed without standing admin rights

Four patterns cover nearly every case:

• IT installs it remotely after verifying the installer.
• Managed deployment pushes approved apps and updates to everyone automatically.
• IT enters admin credentials for a one-off request without handing over the password.
• An employee with a recurring technical need gets a separate admin account used only for that task, never for email and browsing.

The removal sequence that doesn’t lock you out

Don’t strip every admin account in one afternoon. Do it in order:

1. Inventory. List who’s in the local Administrators group on every machine, including old accounts, vendor accounts, and whatever got created during initial setup.
2. Justify. Ask what task each person actually needs admin for. “I update one app occasionally” is not a justification for permanent rights.
3. Verify IT access first. Confirm a working, protected admin account exists on each device before removing anyone else’s, and that each machine has a unique local admin password, not one shared password that unlocks the whole fleet.
4. Test the software. Run each employee’s critical apps from a standard account before the change is permanent.
5. Flip the account. Remove the user from the admin group, have them sign out and back in.
6. Give people a path. One place to request installs, with the program name, reason, and official download page.
7. Re-review on role changes. Admin access should be part of every access review, not a one-time cleanup.

One honest caveat

Removing admin rights narrows what malware can do. It doesn’t make you attack-proof. You still need current software, patching, endpoint protection, email security, MFA, and tested backups. But of all the controls on that list, this one costs the least and gets skipped the most.