What you will achieve

Understand the difference between local administrator and standard user accounts, and run daily work as standard while keeping an admin account for changes.

1) What each account type can do

Administrator can install software, change system settings, and modify other users — UAC prompts appear but the account can consent.
Standard user can run apps and change personal settings but cannot install system-wide software or alter security without an admin password.
Malware running as standard user has fewer privileges to compromise the whole system.

2) Check your current account type

Open Settings → Accounts → Your info.
Under your name, read Administrator or Standard user.
Or run net user %username% in Command Prompt — look for Local Group Memberships.

3) Create a standard account for daily use

Settings → Accounts → Other users → Add account (Windows 11) or Family & other users (Windows 10).
Create a local or Microsoft account, then change its type to Standard User.
Keep one separate admin account with a strong password — sign into it only for installs and system changes.

4) Manage groups with lusrmgr (Pro)

Press Win + R, type lusrmgr.msc:

Open Groups → Administrators — only trusted accounts should appear.
Remove daily-use accounts from Administrators and add them to Users.

5) UAC behaviour per account type

Admins see consent prompts; standard users see credential prompts requiring admin username/password.
Run specific installers as admin without logging into admin desktop: right-click → Run as administrator while signed in as standard.

6) Rename default Administrator

lusrmgr.msc → Users → rename Administrator account on servers and shared PCs to reduce brute-force target.

7) Admin Approval Mode

Split token behaviour: even admins run most processes as standard until elevation — do not confuse with pure standard accounts.

8) Fast User Switching and admin tasks

Standard user can elevate per-task without switching accounts if admin credentials known — UAC credential box accepts separate admin account.
Shared family PC: one admin, multiple standard child accounts with Microsoft Family controls.

Verification checklist

Verify daily account cannot install software without UAC credential prompt. Attempt Settings change requiring elevation — should prompt, not silently succeed.

Reboot once after changes that affect services, drivers, or firmware.
Confirm the original problem is resolved under normal daily use, not only immediately after the fix.
Note date, Windows version (Settings → System → About), and what changed in your personal runbook for next time.