Most of Your Team Does Not Need Administrator Rights

It almost always starts with a reasonable request. Someone needs a printer driver, or a specialist application needs updating, and administrator access solves it in thirty seconds.

The access then stays. Forever.

From then on that employee can approve any installation, change security settings, and make system-level changes that would normally route through IT. So can anything running under their account.

What the permission actually grants

On Windows, membership in the local Administrators group means full control of that machine. Microsoft’s own guidance recommends keeping that group small. macOS works the same way, and Apple likewise advises using a standard account unless the task requires more.

An administrator can typically:

• Install and remove software, including drivers
• Create, modify, or delete user accounts
• Change system and some security settings
• Alter file and folder permissions
• Install background services that keep running

One distinction gets missed constantly. Local administrator access applies to one computer. A Microsoft 365, Google Workspace, or network administrator role is something else entirely, reaching email, cloud files, and accounts across the business. Someone can hold one without the other, and they need reviewing separately.

Why standing access raises your risk

Software normally runs with whatever permissions the person launching it has. That is the whole mechanism.

When a program requests administrator approval, a standard user has to produce credentials they do not have. An administrator just clicks yes. So the employee who downloads a convincing fake installer, or opens the wrong attachment, believes they are approving a routine update while handing the program permission to rewrite the machine.

Microsoft’s own position is that the standard account is both the recommendation and the safer way to run Windows. CISA advises controlling local administrator access and limiting who can install software. Restricting administrative privileges sits in the Australian Cyber Security Centre’s Essential Eight.

There is a second benefit that has nothing to do with malware. When employees cannot approve their own installations, IT gets a look at what is being installed, where it came from, and what it wants access to.

Standard accounts handle normal work fine

This is the objection that stalls the change, so address it directly. A standard account still handles email, browsing, Microsoft 365 or Google Workspace, approved applications, meetings, printing, and file work.

Some applications install per-user without elevation. Others genuinely need it, because they add drivers or system services.

Older line-of-business software is the real friction point. Some was written expecting administrator rights and misbehaves without them. Test those before you change anything; the fix is usually a configuration tweak or a permissions grant on specific folders, not a blanket exception.

Getting software installed without standing rights

Four approaches, and most businesses use more than one:

• IT installs it remotely, and gets to verify the installer came from the vendor.
• Managed deployment pushes approved applications and updates with nobody running an installer.
• Per-request approval. IT enters credentials for that one job without disclosing the password.
• A separate administrator account for the few whose work requires it, used only for those tasks.

That last point deserves emphasis. Even your IT staff should read email from a standard account.

Removing it without locking yourself out

Order matters here, and skipping step three has consequences.

1. Inventory who has it. The local Administrators group on every Windows machine, administrator users on every Mac. Include dormant accounts, shared accounts, vendor accounts, and anything created at setup.
2. Ask why each one has it. A clear business reason should exist. Occasionally updating one application is not one.
3. Confirm IT has a working administrator account on every device, and test it. This is what stops you locking the business out of its own computers.
4. Test the software each person needs under a standard account before you commit.
5. Convert the account, then have the person sign out and back in.
6. Tell staff how to request an installation: program name, reason, official download page.
7. Review on role change and departure, and fold it into your regular access reviews.

One more thing worth checking while you are in there: if every machine shares the same local administrator password, that password working on one device means it works on all of them. Each computer needs a unique password, or a management service that rotates them.

Nobody owns this right now

That is usually the actual finding. Administrator rights accumulate through individually sensible decisions, and nobody tracks the total. MVP Network Consulting audits local administrator access for businesses across Buffalo and Western New York, tests the applications that worry you, and confirms a working administrator account exists before anything is removed. Ask us who has it today.