The Security Mentor

When you installed XP, you had the chance to create one or more separate login accounts for yourself and your family members. Somewhere in there the system asked you to decide whether each new account would be an "administrator". Just what does that choice mean?

Being an Administrator means having complete control over the computer. It's what you need for installing software, doing some kinds of regular maintenance, and also what you need if you want to cause major damage. You're safer not to be an Administrator unless you need to be. If you're not installing software or making system changes, then logging in to an account that's not an Administrator is like having a safety catch on. It's much harder to make dangerous changes when you're logged in to a non-Administrator account.

You want that kind of protection because there are so many ways for bad guys to trick you into running programs they wrote. When you run those programs you're giving them power of attorney. The programs can do anything that you can. If you're an Administrator, they can make your life really difficult.

Sometimes you need to do some administrative work temporarily and then go back to being a "Limited User" for your regular work. There's several ways to do that and there's a guy named Aaron Margosis who has an entire blog about how to make them work. I found one post of his that's non-technical enough to share with normal people. When you read it, remember that "LUA" stands for "Limited User Account", "RunAs" is the Windows feature that lets you run a program as if you were somebody else, and it's safe to ignore the geeky comments at the bottom. Here's a link to the Aaron Margosis HOWTO on running XP at home as a Limited User.