Set Up UAC and a Standard User Account in Windows 11

The Problem

On almost every home PC, the person using it is an administrator. That is convenient, and it is also the single reason most infections succeed: a program run by an administrator can install drivers, disable antivirus, create scheduled tasks, and write to system folders — all without ever asking you.

User Account Control (UAC) is the prompt that appears when something wants those rights. Most people have it turned down, or click through it reflexively. A standard user account is the stronger version of the same idea: daily work happens with no admin rights at all, and elevation requires typing an administrator password rather than clicking Yes.

This costs you a few extra clicks per month and removes an entire category of damage. It is the highest-value hardening step on this list, and the one people skip.

Suspect something already installed itself? Check malicious scheduled tasks and startup persistence before locking things down.

What Actually Changes

| Task | Administrator account | Standard account | |---|---|---| | Browsing, email, Office, games | Same | Same | | Installing an app for yourself | Click Yes | Type admin password | | Installing a driver or system tool | Click Yes | Type admin password | | Malware installing silently | Possible if UAC is lowered | Blocked |

Day to day, the difference is a password prompt on the rare occasions you install something.

The Fix: Step-by-Step

Step 1: Set UAC to Always Notify

Do this first — it applies whether or not you make a second account.

Win + R → useraccountcontrol (or search Change User Account Control settings).
Drag the slider to the top position: Always notify me.
OK, accept the prompt, restart.

The default position, one notch down, does not prompt when Windows' own signed programs elevate — and that gap has been used to elevate silently. The top setting also dims the desktop during the prompt, which is what stops a malicious window from faking a click on it.

Step 2: Create the Administrator Account You Will Keep in Reserve

Do not demote your own account yet. Create a separate admin account first, or you can end up with a PC where nobody can elevate.

Windows + I → Accounts → Other users → Add account.
Choose I don't have this person's sign-in information → Add a user without a Microsoft account.
Name it something clear like PC Admin. Set a strong password — see create strong, memorable passwords — and answer the security questions.
Select the new account → Change account type → Administrator.

Store that password in your password manager. If you lose it and your daily account is standard, you are into resetting a forgotten Windows password, which is a much longer afternoon.

Step 3: Test the Reserve Admin Before You Rely On It

Sign out. Sign in as PC Admin. Confirm it works, then sign back into your own account. Skipping this step is how people lock themselves out.

Step 4: Demote Your Daily Account

Sign in as PC Admin.
Settings → Accounts → Other users → select your everyday account → Change account type → Standard User.
Sign out of PC Admin, sign back into your own account.

Nothing moves. Your files, desktop, browser profile, installed apps, and settings are untouched — only the token your session runs with changes.

Step 5: Learn the Two Elevation Routes

As a standard user:

Right-click → Run as administrator on an installer or on Terminal, then type the PC Admin password.
For a quick admin shell: Windows + X → Terminal (Admin) → enter the password.

Most of the fixes on this site that say "Terminal (Admin)" work exactly the same way — you type a password instead of clicking Yes.

Step 6: Fix the Apps That Genuinely Break

Two categories complain: old software that writes into its own Program Files folder, and tools that need a driver every launch.

For the first, the usual fix is reinstalling the app "for this user" or into a folder in your profile. For the second — hardware monitoring, fan control, some capture software — set the shortcut to always elevate: right-click the shortcut → Properties → Advanced → Run as administrator. You will get a password prompt each launch, which is the correct trade.

If an app fails with a permissions error rather than prompting, see access denied — you need permission.

Step 7: Set Up Every Other Household Account the Same Way

Children, guests, and anyone who uses the PC occasionally should be standard users with their own account. A shared administrator login means one bad download affects everyone's files.

For a child's account, use Add account with a Microsoft account and Family Safety, which adds content filtering and screen-time controls on top.

Step 8: Confirm the Lockdown Holds

As your standard user, try to create a folder directly in C:\. You should be refused. Try to open Terminal (Admin) — you should get a password prompt, not a Yes/No prompt. Both confirm the change took effect.

What Not to Do

Do not turn UAC off. Setting the slider to the bottom does not just stop the prompts — it disables the integrity mechanism behind them and puts every process back at full rights.
Do not use the built-in hidden Administrator account as your reserve. It runs without UAC entirely and is meant for recovery.
Do not use the same password for the reserve admin as your Microsoft account. If one is phished, the other must not follow — and see set up two-factor authentication.
Do not click Yes on a prompt you did not trigger. An unexpected UAC dialog while you are just browsing is a detection, not an inconvenience.

FAQ

Will switching to a standard account break my installed programs?

Almost never. Programs already installed keep working, because they were installed system-wide and run from your profile. The exceptions are old software that writes settings into its own folder under Program Files, and tools that load a driver at launch — both are fixable with the steps above.

Do I lose my files or have to set up Windows again?

No. Changing account type only changes permissions on the same account. Your documents, desktop, browser profile, saved passwords, email, and app settings all stay exactly where they are.

Is UAC at "always notify" annoying in practice?

Less than people expect. On a settled PC you will see it a handful of times a month, mostly when updating software. The prompts cluster during initial setup and then largely stop.

Can I make a single app run without a UAC prompt?

Not safely. The usual workaround is a scheduled task set to run with highest privileges, which effectively creates a permanent no-prompt elevation path — and malware looks for exactly those. If an app prompts every launch, the right fix is updating it or contacting the vendor.

What if I forget the administrator password?

With no other admin account, you are into offline password reset, which is slow and, if BitLocker is on, needs the recovery key first. Save the reserve admin password in a password manager the moment you create it, and keep a second admin account if more than one person uses the PC.

Does a standard account stop ransomware?

It stops ransomware from installing drivers, disabling Defender, and encrypting other users' files or system areas — but a program running as you can still encrypt your own documents. Pair it with Controlled Folder Access and offline backups.

Still Not Working?

If Change account type is greyed out, you are not signed in as an administrator — sign in as the reserve admin. If you have locked yourself out entirely, boot into recovery and follow reset a forgotten Windows password; with BitLocker enabled you will need the recovery key before anything else.