Question Advice for hardening an OS/PC ?

[mustaffa]

Ok, Tom's Hardware... You've never let me down before, so I need your advice. But my ignorance will likely shine in how I ask this question, so please bare with me...

I'm trying to enforce best practice on a PC by seperating user and admin log ins. My goal - log in as a regular user on Windows 11 with the capability to make Admin changes or access certain files/folders with a PIN. Right now I log in with the same creds as my main MS account, something I want to change for obvious reasons.

Would this be best done by creating a dummy MS Account and assigning that account as Admin, then demoting the current main MS Account/Admin to Standard User, or just creating a Local User login for day-to-day? I've just started studying for my Security+ cert which prompted the change. MS says signing in with an actual account is most secure, while the Security+ instructors all say a Local User for day-to-day is most secure.

Thoughts? Any MS-Cyber experts in the house?

Thanks guys!

~M

 

[Math Geek]

leave the main admin user alone. it needs to be there as is

as you've noted a non-admin day to day user is the way to go. you can always do admin stuff from within the standard user by using the admin password on an as needed basis. that's about the best way to go about your day to day. you'd be surprised how little you actually need admin privileges other than installing stuff.

have fun with the rest of the sec+ cert. as you learn more and more it's hard not to go down the rabbit hole of trying to keep your stuff safe. in the end i am just diving into linux for my daily driver as i am not willing to give up all privacy using windows anymore.

good luck

 

[mustaffa]

I'll give that a try, thanks!

 

[USAFRet]

Just create a local Standard user.
Use that for day to day activities.

Only when some sort of admin access is required are you required to enter the PIN.
Don't even need to log into that MS Admin account.

All my systems are aet up like that.
Even further, there are three accounts.

• MS account, only for licensing issues or when I (rarely) need something from the MS Store
• Local Admin, used when admin rights are needed
• Local Standard user. This is the every day account, like I'm using right now.