What is a standard user account?
Windows has two everyday account types: standard user and administrator. A standard user account belongs to the local Users group and not to the Administrators group. It can sign in, run installed programs, save files in its own profile and change personal settings such as its wallpaper, password and sign-in options. Anything that affects every user or the operating system itself needs someone to supply administrator credentials first.
What a standard user can and cannot do
| Task | Standard user? |
|---|---|
| Run installed apps, browse the web, print to installed printers | Yes |
| Change own wallpaper, password, PIN and other personal settings | Yes |
| Install Microsoft Store apps or per-user installers that write only to the profile | Usually yes |
| Install software into Program Files or add new device drivers | No, needs admin credentials |
| Create or delete accounts, or change another account's type | No |
| Change firewall, BitLocker or other system-wide security settings | No |
Write to C:\Windows, C:\Program Files or HKEY_LOCAL_MACHINE | No |
How UAC treats a standard user
When a standard user starts something that needs elevation, User Account Control shows a credential prompt asking for the user name and password of an administrator account. An administrator sees a consent prompt instead, which only asks Yes or No. So if a UAC box asks for a password, the signed-in account is a standard user. When a technician types admin credentials into that prompt, only that one task runs elevated; the user's session stays standard.
Creating or changing a standard account
- Settings (Windows 11): Settings > Accounts > Other users > Add account (Family & other users on early Windows 11 builds). New accounts are standard users by default. To switch, select the account, choose Change account type and pick Standard User or Administrator.
- Control Panel: User Accounts > Manage another account > Change the account type.
- Elevated Command Prompt:
net localgroup administratorslists who is an admin, andnet localgroup administrators jsmith /deleteturns jsmith back into a standard user. - Local Users and Groups (
lusrmgr.msc, Pro and higher editions): the Member Of tab shows each account's groups. whoami /groupsshows the groups in the current user's session.
Why daily use should be standard
Signing in as a standard user applies the principle of least privilege. Malware that a user launches by accident runs with that user's rights, so it cannot quietly install services or drivers, switch off security tools or replace system files. Organizations give employees standard accounts and give technicians a separate admin account that they use only when a task requires it. A home user who owns the PC can do the same: keep one admin account for maintenance and use a standard account for email and browsing.
Troubleshooting cues
- User cannot install an app and gets a password prompt: expected for a standard account. Install it with admin credentials if policy allows, or deploy it centrally.
- An older app fails because it writes to Program Files or HKLM: grant permissions on the specific folder or key the app needs rather than making the user an administrator.
- A user was made an administrator during setup: the first account created on a PC is an admin. Create a separate admin account, then change the user's type to Standard User.
Standard user account on the CompTIA A+ exam
This topic falls under Core 2 (220-1202) objective 2.2, which covers Windows users, groups and permissions, and objective 2.7, which covers workstation hardening and best practices. Expect scenarios where a user should not be able to install software or change system settings: the answer is a standard account, not an administrator account with instructions to be careful. Know that a standard user gets a UAC credential prompt while an administrator gets a consent prompt, that new accounts made in Settings default to standard, and that giving users admin rights to "fix" an app is the wrong answer when least privilege is the goal.