Don’t run everyday life as the administrator
If the account you browse, email and work in all day is also the one that can install software and change everything, then anything that catches you - a dodgy download, a convincing scam - inherits those powers too. A separate admin account, used only when something genuinely needs it, shrinks what any single mistake can do. Most useful if you run a business or charity, or manage anyone else’s access.
Make a standard account for daily use
On Windows or Mac, create a second user without administrator rights and do your everyday work in that. Keep the admin account for installing and configuring only. It’s ten minutes once, and quietly defuses a whole class of problem.
Treat the admin prompt as a speed bump
When something genuinely needs admin, you’ll be asked for the admin password. That prompt is useful: if it pops up when you weren’t installing something, that’s your warning to say no and look closer.
For a team: give the access the role needs, no more
Not everyone needs to be an administrator. Give each person the access their job requires and nothing extra - fewer admin accounts means fewer keys to the kingdom that can be lost, phished, or misused.
Ring-fence the accounts an attacker actually wants
Your domain registrar, your email-hosting admin, your payment accounts - these are the real targets. Give each a unique login and strong two-step, and don’t share them on a sticky note or a group inbox. Losing one of these is losing the business.
“This sounds like a lot for one person.”
If it’s just you on one laptop, the single highest-value bit is simply not browsing the web logged in as an administrator day to day. Do that one thing; the rest is for when you’re responsible for other people’s data too.
Last checked: 19 October 2026.