Vista - Safer to use user non-admin account?

I'm coming from a mac where a very simple way to stop many programs you don't want is to not use the admin account. It has several advantages.

1. If you mess up the user account you don't have to format. Just go into admin to fix it, wipe it, or delete it.

2. It can stop malware and such because it requires the admin account password to choose to install programs or modify system files.


Would I see the same advantages in Vista using this method or is it not necessary/helpful?

 

Abso-freakin'-loutley!!! Despite all the "suggestions" you will see from so called experts, that you should turn off UAC (User Access Control), it is the function in Vista that gives exactly the sort of protections you are talking about.

 

+1. UAC is the best thing since sliced bread .

 

Is it still helpful to not use the admin account and have a separate user account as well?

 

While he went off on a little tangent, his answer was pretty clear

 

people who tell you to turn off UAC either haven't used it since before SP1, or don't know what they're talking about.

 

I will leave the UAC on, but I'm wondering about not using an admin account and using a user account.

 

Yes, it is an additionaly layer. Layers of security are ALWAYS a good thing.

Gary

 

That's the thing about UAC. As long as you have it on, you will have all of the access of an admin account, but with all of the safety of a non-admin account.

So to answer your question, yes, it is safer to use a non-admin account, and there are no significant downsides as long as UAC is turned on (it allows you to gain admin privileges when you need them).

 

Yes, a non-admin account on Vista works pretty much the way you describe and expect.

The default setup in Vista, an admin account with UAC, is kind of a halfway-house between a standard user and a traditional admin account. But for best security, Microsoft recommends (I don't have a link handy...) that you create a non-admin account and use that as you describe. I don't know exactly what the security advantages are of non-admin (vs. admin w/ UAC), other than that UAC will make you enter a password to do admin stuff, instead of just clicking OK. I'm not saying there aren't some other advantages... I just don't know.

The main (potential) downsides vs. an admin account are: a password is required for admin actions, and some old and poorly-written programs may not work correctly when run as a non-admin user. In practice I find that the vast majority of modern and semi-modern programs work fine, and you can always log into your admin account if you need to run something that doesn't.

One other thing to be aware of is that when running as a non-admin user, a few things run in a kind of read-only mode. Device Manager is one example of this, but there are others too. If you need to make changes, you may need to right-click and do "Run as administrator" to get privilege escalation, for Device Manager and other programs which allow you to change the system config. Alternatively, you can log in as your admin account and make the changes there. If you're not sure what I'm talking about... don't worry, it's not a big deal, it all will make sense later, and you'll figure it out as you go along.

 

wow, the whole time I was posting, I thought that I was using a non-admin account, until I read your post and found out that I'm on an admin account.

I guess as a revision to my last post, using a non-admin account is safer, and the only downside is you will have to enter your password.

 

Thank you very much everyone. If I can myself safer with very little effort I will do that.

 

I've run Vista both ways, and to be honest, I'm ok with either.

If you are sharing your computer with anyone, I highly recommend giving them a non-admin account (and NOT giving them the admin password) so that they can't mess up the system. But for an individual user, I could go either way. IMO the default setup of admin account with UAC provides a pretty nice balance between convenience and security and that's what I'm using at the moment.

 

I reccomend an admin account with UAC turned on. You should get to know your programs - if MS Word wants UAC confirmation, you know something is wrong. But a non-admin account is just a hassle and waste of time. Admin accounts are safe, and your system is airtight if you have a good AV + antispyware + Comodo Firewall.

 

+1...Non-password generic account is good for when family visits and want to check their email, or something...or for when the free-loading roomie wants to log-on while you're at work...or for when the toddler wants to play Dora and you have to pee (toddler with admin privilege = )...that, and parental controls...

 

I've been using Vista under a non-admin account since I received my notebook two years ago. It's been pretty smooth sailing.

 

I agree. Frankly, I wish the out of box behavior was to encourage you to create and log in as a non-admin account. Instead, the default behavior is to log you in as an admin, then annoy you to death. I like the approach of the various unix/linux flavors: keep the admin account wide-open but at arm's length, and encourage the use of personal accounts as much as possible.

About the only problem is that Vista isn't quite as polished when it comes to separating the things that really should require admin access from the things that don't: everything is sort of commingled (sp?) around the control panel, registry, services model, etc., so it's harder for Vista to draw the line between what's a privileged action and what isn't, at least in any sort of consistent fashion.

 

Maybe 7 will address this issue. I'm getting into windows vista late in the ballgame. I prefer XP, but am getting 4GB of RAM so vista 64 it is.

 

I agree it is a better idea to use a non-admin account, but even doing so is not going to change the number of "nags/annoyances" if you are performing the same operations under either type of account. The only difference is whether or not you have to provide an admin password.

Gary

 

Like most have said, keep UAC running. It is extremely useful.