Why should staff use separate admin accounts?

An admin account can install software, change security settings and see everything. If someone using an admin account opens a harmful attachment, the harmful software gets the same full control. An everyday account without admin rights limits the damage.

Cyber Essentials expects admin rights to be given only to the people who need them, and admin accounts to be used only for admin tasks, never for email or web browsing.

How to check your own setup

• Windows. Settings, then Accounts. Your account shows as Administrator or Standard user.
• Mac. System Settings, then Users and Groups. Admin accounts are labelled Admin.
• Microsoft 365 or Google Workspace. look at who holds admin roles in the admin centre or Admin console. Is it more people than you expected?

How to fix it

1. Give every member of staff a standard, everyday account for normal work.
2. Create a separate admin account for each person who needs one, with a clearly different name such as admin.jane.
3. Use the admin account only when installing software or changing settings, then sign out.
4. Keep the number of people with admin roles in Microsoft 365 or Google Workspace as small as possible, with MFA on every one.
5. Review the list of admins every few months and remove anyone who no longer needs it.

The mistakes people make

• The business owner's everyday email account being the main Microsoft 365 or Google admin.
• Giving everyone admin rights because it stops them asking for help installing things.
• Former staff or old IT providers still holding admin accounts.

More on accounts and passwords. How do I turn on multi-factor authentication? · How do I stop staff reusing passwords? · How do I remove access when someone leaves?

Next, read How do I stop staff reusing passwords?