User accounts, groups, and least privilege as something you can actually do

Why this matters

Least privilege is the security principle that sounds like a slogan and is actually a set of small, boring decisions: which account someone signs in with, which group they are in, and what they are prompted for. Every one of those is made by a support technician, usually in a hurry, and the accumulated result is what an attacker inherits when one user clicks the wrong thing.

The exam asks about this concretely — what an account type can do, what a prompt grants, which default accounts should be disabled — because those are the decisions. The principle is only useful once it is attached to them.

The lesson

Account types, and why daily work does not happen in an administrator account

Windows has two account types that matter for daily work, and the difference is what happens when something asks for more.

Standard accounts can do everything a user needs: run applications, save files, change their own settings, install user-scoped software. What they cannot do is change the system — install drivers, write outside their profile, change other accounts, or modify protected settings — without an administrator authorising it.

Administrator accounts can do all of that, and so can anything running as them.

That last clause is the argument. When a standard user runs something hostile, it runs with standard rights: it can encrypt that user's files, which is bad, and it cannot install a driver, disable security software, create a service, or touch other users. When an administrator runs the same thing, it can do all of those, and the machine is no longer trustworthy.

So the guidance is: daily work happens in a standard account, and administration happens by authorising a specific action or by signing in to a separate administrative account when something larger is needed. That is genuinely normal on macOS and Linux and still resisted on Windows.

For a technician's own working practice the same applies, with more force: an administrative account used for browsing and mail is the single most valuable thing on the estate.

Groups as the unit of permission, and the estate that grants everything directly

Permissions granted to individuals do not scale, and every estate that grants them directly ends up in the same state.

Groups are the unit. Access is granted to a group; membership of the group is what changes when a person joins, moves or leaves. The standard pattern is to name groups after the thing being accessed — Finance-Reports-ReadWrite — rather than after the people, because people move and the resource does not.

The built-in groups worth knowing:

• Administrators — full control of the machine.
• Users — the standard group.
• Power Users — a legacy group that no longer confers meaningful extra rights and exists for compatibility. Adding someone to it does almost nothing, which is a classic exam point.
• Remote Desktop Users — may connect remotely without being administrators, which is the correct way to grant remote access.
• Backup Operators and similar — narrow rights for a specific job, and worth knowing because they are powerful in non-obvious ways.

The estate that grants everything directly is the failure mode: a hundred folders each with a handful of named users, accumulated over years. Nobody can answer "what can this person reach?" or "who can reach this?", and when someone leaves, their access is removed from the places anyone remembers. The fix is slow and it is worth starting: new access goes to groups, and folders get converted as they are touched.

User Account Control: what the prompt means and what clicking yes grants

User Account Control is the mechanism that lets an administrator account run with standard rights most of the time, and the prompt is the moment it hands them over.

What the prompt means, precisely: something is asking to run elevated, with full administrative rights. Two forms appear:

• Consent — you are already an administrator, and it asks you to confirm.
• Credentials — you are a standard user, and it asks for an administrator's password. This is the one to use when helping a standard user, and it elevates that process rather than giving the user administrative rights.

What clicking yes grants: full control of the machine, to that process and everything it starts. It is not a permission to do the one thing you were thinking of; it is the whole set.

Three things worth knowing:

• The secure desktop. The screen dims and the rest of the desktop is frozen, so a normal application cannot fake the prompt or click it for you. Turning that off to stop the flicker removes a real protection.
• Lowering the slider is not "turning off the annoying prompt" — at the lower settings, changes made by Windows' own signed utilities no longer prompt at all, which is a genuine reduction in protection. Off entirely means every process an administrator starts is elevated, which is the pre-UAC world.
• A prompt you did not expect is information. Something asked for administrative rights when you did not do anything. The correct response is no, followed by finding out what it was.

Guest, service and default accounts, and disabling what nobody uses

Default accounts exist on every machine, and the ones nobody uses are the ones attackers rely on.

• Guest — disabled by default on modern Windows and should stay that way. Its whole purpose is unauthenticated access, and there is no current reason to want that on a workstation.
• Administrator — the built-in local administrator, disabled by default, and a well-known name that appears in every credential-guessing list. If it is enabled, it should have a long unique password, and in a managed estate that password should be unique per machine rather than the same everywhere. Identical local administrator passwords across an estate turn one compromised machine into all of them.
• DefaultAccount and similar system accounts — managed by Windows, left alone.
• Service accounts — accounts that software runs under. The rules are that they should be specific to the service, should have only the rights that service needs, should not be members of Administrators unless genuinely required, and should not be used by people to sign in.

The audit worth doing on any machine you are handed: list the local accounts, and for each one ask who uses it and why. Accounts belonging to people who left, accounts created for a project that finished, and accounts whose purpose nobody can state are all findings, and all of them are ordinary.

Disable rather than delete when you are unsure — a disabled account keeps its security identifier, so the permissions it held are still traceable, and it can be re-enabled if it turns out to matter.

Reviewing who has access, which is the control that catches the drift

Access drifts upward. People join projects and their access is added; the project ends and nothing is removed. Over a couple of years an estate's permissions describe everything everybody has ever done rather than what they do now.

The review is the control that catches it, and it is two questions asked regularly:

• Per person: what can this account reach, and is that still what the job needs?
• Per resource: who can reach this, and should they?

Where to look, practically: local group membership on the machine, the groups an account is in on a domain, shares and their permissions, and the accounts with administrative rights anywhere.

The events that should trigger a review rather than waiting for a schedule:

• Someone joins, changes role, or leaves. A role change is the one that gets missed — access is added for the new job and the old access stays.
• A project finishes.
• A machine changes hands.
• Any security incident, because the first question afterwards is what the compromised account could reach.

The professional habit for a support technician who is not the person running the reviews: report what you see. Noticing that a shared folder is open to everyone, or that a departed colleague's account is still enabled, and putting it in the ticket, is a genuine contribution. It costs a sentence and it is frequently the only way the finding reaches anyone.