Who should have admin rights on business computers?

An administrator account can install software and change almost any setting. That power is also what malware wants. Fewer admins means fewer ways in.

Why it matters

If someone with admin rights clicks a bad link or opens a dodgy attachment, a virus can install itself fully and take over the computer. If they are a standard user, the damage is often limited. Limiting admin rights is also part of Cyber Essentials.

A simple rule

• Everyday work should be done on a standard account.
• Admin rights are for the person or provider who looks after IT, used only when needed.
• Business owners are often the worst offenders. Being the boss does not mean you need admin for emails and spreadsheets.

How to put it into practice

1. List everyone who has admin rights on each computer and cloud service, such as Microsoft 365, Google Workspace, your website, and your domain name.
2. Ask of each person: do they need this to do their job every day? If not, change them to standard.
3. Create a separate admin account for admin tasks, with a strong, unique password and two-step sign-in. Do not use it for email or browsing.
4. Make sure at least two trusted people can reach the main admin accounts, so you are never locked out.
5. Store admin details safely, for example in a password manager or a sealed note in a safe.

Things to watch

• Staff may ask for admin so they can install a program. Create a simple request process instead.
• Remove admin rights when people leave or change role.
• Review the list a couple of times a year.

When to get more help

Get help if you do not know who the admins are, if software will not run without admin rights, if you have shared admin passwords, or if you need to move people to standard accounts without breaking their work.