Separate administrator access from everyday work

Decide which tasks need elevation

Reading email, browsing documentation and editing ordinary files should not require routine administrator privileges. Installing system software, changing protected settings and managing other accounts usually do. Separating these activities reduces how often a mistake or malicious application operates with broad authority.

This exercise uses built-in account features. It does not require a paid identity platform. On a company-managed computer, ask the responsible administrator to apply the change through the established management process instead of creating an unmanaged account.

Prepare the two-account workflow

1. Record the existing administrator accounts and how you recover access. Confirm there is an authorised administrator whose credentials actually work before changing your daily account.
2. Create or identify a separate administration account using the operating system's supported account controls. Give it a unique strong password and a clear purpose. Do not share its credentials casually with everyone who uses the computer.
3. Test an administrative action from the separate account, such as viewing a protected system setting. Then use a standard account for ordinary browsing and document work.
4. When a legitimate task requires elevation, read the prompt and approve only the expected application. On Linux, use the authorised sudo route. On Windows, use the elevation prompt rather than permanently running the browser as administrator.

Verify the separation

From the daily account, attempt to change a protected system setting. The system should request authorised administrator credentials or deny the operation. Also confirm that ordinary applications and file access still work. A successful restriction that prevents required business work needs a planned adjustment, not a blanket return to administrator status.

Watch for misleading exceptions

Some applications incorrectly demand elevation for routine use. Investigate their supported configuration, installation location and file permissions. Do not disable user-account controls or grant everyone write access to system folders simply to silence a prompt.

Keep recovery deliberate

Store administration recovery material securely and test the route after account or device changes. Retain only the administrators you actually need. Separation reduces routine privilege exposure; it does not make malicious software harmless or eliminate the need to update the computer and maintain recoverable backups.