Chillyfinger

Essential changes to a Windows machine to reduce vulnerability to malware, especially to AI agents.

 Don't change your only administrator account to Standard until you have verified that another account can administer the PC. Otherwise, you can lock yourself out of installing software, changing system settings, or reversing the change.

Recommended setup

The safest arrangement is:

Account	Role	Use it for
A separate local administrator account	Administrator	Installing trusted software, Windows configuration, recovery
Your usual Windows/Microsoft account	Standard User	Daily browsing, email, documents, streaming, and ordinary work

This reduces the chance that an unexpected installer—including a remote-management or malicious “agent”—can gain system-level permissions. Windows will ask for the separate administrator’s credentials when a legitimate task requires elevation.[learn.microsoft]

Step-by-step: Windows 11

1. Create a separate administrator account

While signed in to your current administrator account:

1. Open Settings with Windows + I.
2. Select Accounts → Other users.
3. Choose Add account.

4. For an offline/local admin account, choose:

   • I don’t have this person’s sign-in information
   • Then Add a user without a Microsoft account
5. Create a distinct account name, such as PCAdmin—do not use something easy to guess.
6. Set a long, unique password and save it securely.

Microsoft’s Settings workflow places account management under Accounts → Other users, where you can choose an account and use Change account type.[support.microsoft]

2. Make that new account an administrator

Still in:

Settings → Accounts → Other users

1. Select the new account you created.
2. Beside Account options, click Change account type.
3. Change Standard User to Administrator.
4. Click OK.

3. Verify it before changing your daily account

This is the critical precaution:

1. Sign out of your current account: Start → your profile picture → Sign out.
2. Sign in to the new PCAdmin account.

3. Confirm it can open an elevated prompt:

   • Search for Command Prompt.
   • Right-click it and select Run as administrator.
4. If Windows allows the elevation without asking for another account’s password, the new account is working as an administrator.
5. Sign out and return to your normal account.

Only after this test succeeds should you demote your current account.

4. Change your usual account to Standard User

Sign back into the separate administrator account, then:

1. Open Settings → Accounts → Other users.
2. Select your ordinary account—the one you use every day.
3. Choose Change account type.
4. Select Standard User.
5. Click OK.
6. Sign out and sign back in to your usual account.

Your documents, desktop, installed apps, and Microsoft-account connection should remain in place; you are changing its permission level, not deleting or replacing the profile.

Windows 10

The approach is the same, although the labels may be slightly different:

1. Sign in to the separate administrator account.
2. Open Settings → Accounts → Family & other users.
3. Under Other users, choose the account to demote.
4. Click Change account type.
5. Select Standard User → OK.
6. Sign out and test the standard account.

What happens afterward

When you try to install software or make a protected system change from the Standard account, Windows should show a UAC credential prompt. Enter the credentials for the separate administrator account only when you recognize and trust the action.

For example, rather than approving an unexpected “Install support agent” prompt, select No. If you intentionally install a program you downloaded from its legitimate publisher, use your PCAdmin credentials at that point.

Important exceptions

• Work/school-managed PC: Your organization may control account types through Active Directory, Intune, or other management software. A local change may be blocked or later reverted.
• Microsoft Family account: Account-type controls may appear in Family settings rather than—or in addition to—the ordinary Other users page.
• Windows Home edition: The Settings method above works. Tools such as Local Users and Groups (lusrmgr.msc) are usually not included, so do not depend on them.
• Do not remove all administrators: Windows requires at least one working administrator account for normal administration and recovery. Microsoft notes that changes to account type require administrator access.[learn.microsoft]

Optional: make prompts stricter

After you have tested the two-account arrangement, set UAC to its stricter level:

1. Search Windows for Change User Account Control settings.
2. Move the slider to Always notify.
3. Restart if Windows requests it.

That will make elevations more visible and helps ensure you notice when software is attempting to alter the PC.