guidox / Security
Create a second admin, demote your daily account with **Remove-LocalGroupMember**, and elevate per task with **Run as different user**. Check the result with **whoami /groups**.
**whoami /groups** shows the groups of the running token, including the administrators group with its integrity level. A standard account carries the group but it is deny-only.
whoami /user
whoami /groups | Select-String -Pattern 'S-1-5-32-544|Mandatory Label'
Get-LocalGroupMember -Group Administrators | Select-Object Name,PrincipalSourceDemoting your only admin account locks you out of every elevation prompt. Sign in once with the other account and open an elevated shell before you change anything.
Get-LocalUser | Select-Object Name,Enabled,LastLogon
# switch user, sign in as the second admin, open PowerShell as administrator
whoami /groups | Select-String -Pattern 'S-1-5-32-544'**Remove-LocalGroupMember** takes the account out of the administrators group. The change applies at the next sign-in, because the current token keeps its groups until then.
Remove-LocalGroupMember -Group Administrators -Member "$env:COMPUTERNAME\dailyuser"
Get-LocalGroupMember -Group Administrators
# sign out and back in
whoami /groups | Select-String -Pattern 'S-1-5-32-544'**ConsentPromptBehaviorAdmin** controls the prompt for administrators; **EnableLUA** must stay at 1. Turning UAC off also disables the token split that makes a standard account meaningful.
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' | Select-Object EnableLUA,ConsentPromptBehaviorAdmin,PromptOnSecureDesktop
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 1 /f**Run as different user** starts a single process with the admin credentials. That is the habit that replaces an admin desktop: one window elevated, everything else standard.
# Shift+right-click the app > Run as different user > admin credentials
runas /user:PC01\AdminBackup cmd
whoami
whoami /groups | Select-String -Pattern 'S-1-5-32-544'The daily shell must report a medium integrity level and a deny-only administrators group. Anything else means the demotion did not apply or the session was not restarted.
whoami /groups | Select-String -Pattern 'Mandatory Label|S-1-5-32-544'
Get-Process -IncludeUserName | Where-Object UserName -like "*dailyuser*" | Select-Object -First 5 Name,IdThat is the design. Use Run as different user for whole applications and give the standard account write access to the folders it needs.
It writes to Program Files or HKLM. Check with Procmon; a vendor update or a junction to a writable folder is the fix, not admin rights for everything.
The token is cached until sign-out. Sign out completely, or reboot, then check whoami /groups again.
Windows Update runs as SYSTEM and is unaffected. Software that needs elevation needs the admin account, which is the point.
It stops the malware from writing to system locations without a prompt. Anything that runs in your user context can still read your documents.
No. That account is disabled by default and should stay that way; a named second admin with its own password is easier to audit.
That is the default and better than nothing, but the browser still runs in the same account. The split account removes that link entirely.
Add the account back with Add-LocalGroupMember -Group Administrators -Member "PC01\dailyuser" and sign out. UAC settings were only read, not changed.
Free · no account needed · tracks your progress