Should Employees Have Local Admin Rights? A Plan to Remove Them
When we first look at a company’s PCs, even in a 20-person office, we usually find everyone is a local administrator on their own machine. Nobody chose that on purpose. Whoever set the laptop up added the user to the Administrators group to save time, and it stayed that way.
The cost shows up the day someone opens the wrong attachment. Malware runs with the rights of the person who launched it. If that person is an admin, it can switch off security tooling, install services and delete backup shadow copies. If they are a standard user, most of that hits a wall.
Why does admin access matter so much?
BeyondTrust’s annual Microsoft Vulnerabilities Report (2025 edition) states that removing local admin rights and controlling application execution has historically mitigated about 75% of critical Microsoft vulnerabilities. The figure moves from year to year (it was 56% in the 2020 data), but the direction never changes: fewer rights, fewer exploitable bugs.
In practice, that means:
- Ransomware has a harder time stopping backup and security agents.
- Users cannot install an unknown driver or a “free PDF tool” on their own.
- A stolen user account is no longer a ready-made key for moving to other machines.
- PCs stop drifting away from the standard build over time.
Why not strip everyone’s rights in one weekend?
We have seen companies do it on a Saturday and then wait for the phones on Monday. The accounting package cannot update, the plotter driver will not install, an old plug-in refuses to open. To the employee, security becomes “the thing that blocks my work”, and it gets rolled back at the first opportunity.
A better order:
- Take inventory. Who is a local admin on which machine, and who actually uses that right?
- Write the exception list. Which applications truly must run as admin? It rarely goes beyond three to five items.
- Start with a pilot group. IT plus four or five volunteers, for one to two weeks.
- Roll out in waves. Leave teams on old desktop software, such as accounting, for last.
- Keep the help desk ready. Expect “I need rights” tickets for two weeks and answer them the same day.
For a company of 20 to 50 people, the whole thing usually takes four to six weeks.
How do you handle the exceptions?
Once rights are gone, a printer driver, a legacy ERP client or a developer tool can genuinely break. Your options:
| Situation | Approach |
|---|---|
| One-off installation | IT installs it remotely, the user gets no rights |
| One app demands admin | Allow only that app through a privilege elevation tool |
| Employee who writes software | A separate admin account for that work only, never the daily one |
| Legacy software that never changes | Update or replace it, do not turn a workaround into a permanent fix |
One more rule: the admin account IT uses should not share the same password on every machine. Windows LAPS solves that. Since the April 2023 updates it is built into Windows 11, Windows 10 and Windows Server 2019/2022, with no separate package to install. Each computer gets its own local admin password, rotated on a schedule and stored in Active Directory or Entra ID. If one machine’s password leaks, you lose that machine and nothing else.
What do you say when employees push back?
They will. “Shouldn’t I be in charge of my own computer?” My answer is always the same: this is not about trust. Lowering an employee’s rights really means lowering the attacker’s rights. If the account of an admin user is taken over, everything on that machine goes, their own files included.
A small tip: pair the change with a hardware refresh. Companies that hand out new laptops with standard accounts get almost no complaints, because nobody remembers the old setup.
Frequently asked questions
Can a standard user update software? Apps installed in the user profile, such as the browser, Teams and Office, usually update fine. Machine-wide applications need IT to push updates centrally.
Does removing admin rights replace antivirus or EDR? No. Restricting rights limits the damage malware can do. Detection and response are a separate layer, and the two work together.
What about remote workers who never connect to the VPN? If policies are delivered through cloud-based device management, the machine stays current even off the office network. Relying only on on-premises domain policy leaves a gap here.
How do I list my admin accounts?
On each machine, run Get-LocalGroupMember -Group "Administrators" in PowerShell. If you have a central management tool, it can pull the inventory in one go.
If you would like us to pull the list of admin accounts and plan the switch for you, get in touch.
Related Posts
Company Laptop Stolen: Was BitLocker On? How to Check Every Device
A stolen laptop costs less than the data inside it. Here is how to check whether each disk is encrypted, where the recovery key actually lives, and how to audit one device in about seven minutes, with the Türkiye KVKK angle.
Read more: Company Laptop Stolen: Was BitLocker On? How to Check Every Device
Employee Offboarding: Which IT Accounts to Close, and in What Order
The employee has left, but their mailbox, VPN, cloud admin panels and shared passwords are still live. Here is the order we use to cut access on the last day without losing mail, files or the domain account.
Read more: Employee Offboarding: Which IT Accounts to Close, and in What Order
Firewall Subscription Expired? What Stops Working and What to Do
When a firewall license lapses, the box keeps passing traffic while IPS signatures, web filtering and sandboxing quietly freeze. Here is what stops, what a late renewal costs, and how to decide between renewing and replacing the appliance.
Read more: Firewall Subscription Expired? What Stops Working and What to Do