Handing over a signed-in desktop is how private files get seen. A standard account without admin rights solves that in five minutes and leaves your profile alone.
Create a **local standard account** for guests, keep it out of the **Administrators** group and clear everything private out of **C:\sers\ublic**. Sign out of your own account before the laptop changes hands.
In **Settings > Accounts > Other users** add an account and choose **I don't have this person's sign-in information**, then **Add a user without a Microsoft account**. A local account needs no email and no cloud profile.
Settings > Accounts > Other users > Add accountOpen the account and check the type. **Standard user** cannot install drivers, change system settings or approve a UAC prompt with your PIN. Administrator would give the guest all of that.
Anything in **C:\sers\ublic** is readable by every account on the machine. Empty it before a visit and keep shared files in a folder you control instead.
%PUBLIC%Your own profile is protected by default: another standard user cannot open C:\sers\you>. What does leak is everything you dropped on the guest desktop, in shared drives and in browser autofill on that account.
Fast user switching keeps your session alive and your notifications ready to pop up on the lock screen. Signing out ends the session and leaves nothing of yours running in the background.
Start > account picture > Sign outFor a one-off visitor, delete the account and its data in **Settings > Accounts > Other users**. For a regular guest, leave it and clear the downloads folder now and then.
They sit in C:\sers\ublic or on a shared drive. Move them into your own profile, which the guest account cannot open.
The account was created the wrong way. Delete it and repeat the step with Add a user without a Microsoft account.
That is the sign-in setup for the new account. A PIN here is for the guest account only and does not touch yours.
The account is an administrator. Change the type to Standard and have the guest sign in again.
It is disabled by default and re-enabling it is an old trick with a weak password model. A standard local account does the same job properly.
Yes. Programs are installed for the machine, but the guest gets a separate profile without your settings or saved passwords.
Delete the account in **Settings > Accounts > Other users** and choose to remove its data. Your own profile and files are not affected.
Free · no account needed · tracks your progress