The setting nobody ever revisits
Here’s how it usually goes. You buy five laptops. Somebody sets them up, probably you or a friend who’s good with computers. Everybody gets an account, everybody can install what they need, and the office runs. Nine years later those same accounts are still full administrators and nobody has thought about it since.
I bring this up on almost every assessment I do, and the reaction is always the same. It sounds like a nitpick. It isn’t. Admin rights are the difference between one infected laptop and every file in your business getting encrypted on a Tuesday afternoon.
What admin rights actually mean
An administrator account can change anything on that computer. Install software, turn off security tools, create new accounts, reach into system files, dig credentials out of memory. A standard user can do their job and not much else.
Malware inherits whatever the logged-in user has. If your receptionist opens a bad attachment while running as a standard user, the damage stops at her documents folder and her profile. Ugly, but survivable. If she’s an admin, that same file can disable the antivirus, plant itself so it survives a reboot, grab saved credentials, and start reaching for other machines on the network.
Microsoft has published numbers on this for years, and the pattern holds: removing admin rights neutralizes the large majority of critical Windows vulnerabilities outright. Not patches them. Makes them not work.
Ransomware needs the keys
Almost every ransomware case I’ve read up close follows the same shape. Somebody gets in on one machine. That first foothold is rarely the goal. What the attacker wants is credentials with enough power to move sideways and reach the file server or the backup system.
If the first machine they land on has a local admin account, they’ve saved themselves a week. If that local admin password is the same on all twelve of your machines (extremely common in small offices, because whoever set them up used one password for all of them), then they now own the whole office. One compromised laptop becomes twelve.
Cutting admin rights doesn’t stop somebody from getting in. It stops them from getting everywhere.
But we need to install stuff
This is the objection every single time, and it’s fair. Let me be specific about what actually breaks and what doesn’t.
Things that keep working normally: Microsoft 365, browsers, Zoom, Teams, printing, VPN clients, most line-of-business software once it’s already installed, Windows updates.
Things that need a plan: old accounting or industry software that writes to Program Files (some medical and legal software is guilty here), certain printer and scanner drivers, and any process where staff routinely install their own tools.
The old software problem is real but it’s solvable. Usually the fix is granting write permission to one specific folder rather than handing over the whole machine. It’s a couple of hours of work and then it’s done forever.
The 30-day version
You don’t rip admin rights away on a Monday morning. That’s how you end up with an angry office and a rollback. Do it in order.
Week 1: find out what you’ve got
Make a list of every computer and who logs into it. On each one, check whether that user is an administrator. In Windows, Settings, then Accounts, then Your info will tell you. Also write down which machines share the same local admin password, because that’s a separate fire.
Week 2: build a real admin account
Create a separate admin account on each machine with a unique password. Not the same one everywhere. Unique per machine, stored in a password manager, and never used for daily work or email. That account exists to approve installs and nothing else. If you’re doing this for more than a handful of machines, there’s tooling that rotates these passwords automatically so you’re not managing a spreadsheet.
Week 3: convert one person
Pick your most patient employee, drop their account to standard user, and let them work for a week. Write down every time they hit a wall. That list is your real compatibility test, and it’s almost always shorter than people fear.
Week 4: do the rest
Convert everybody else. Tell them ahead of time what’s changing and who to call when they need something installed. Set the expectation that installs go through one person now, and that’s a feature, not a hassle.
The other admin problem: your cloud
Local admin is half the story. Go look at your Microsoft 365 admin center right now and check how many Global Administrators you have. If you’re a ten-person company and the answer is four, you have a problem. Two is the right number for most small businesses. One primary, one break-glass account that’s stored securely and almost never used.
Same logic applies. A Global Admin account that gets phished hands over every mailbox, every file in SharePoint, and the ability to create new accounts nobody notices for months. And your former IT guy should not still be on that list, which is a conversation I have more often than you’d think.
What it costs versus what it saves
Removing admin rights costs you a few hours of setup and a small change in office habits. The trade is that the most common attacks on small businesses stop working. There’s no monthly fee, no new appliance, no license. It’s a configuration change.
Compare that to the average small business ransomware recovery, which runs into weeks of downtime and tens of thousands of dollars even when the backups are good. I’d rather spend the afternoon.
Where to start
Go check one laptop today. If a normal employee can install software without being asked for a separate password, you’ve confirmed the issue in ten seconds.
If you want this handled properly across the whole office, including the old software that everybody’s scared to touch, get in touch. We do this for businesses from Delray Beach up through West Palm and it’s usually a one-day project. Securing systems, supporting people.