guidox / Security
Create a second local account, keep both as standard users with one admin, and let fast user switching keep sessions alive. Verify isolation with **icacls** on the profile folders.
A machine with one account has no isolation at all until a second profile exists. The profile list shows what is already there, including stale profiles.
Get-LocalUser | Select-Object Name,Enabled,LastLogon,Description
Get-CimInstance Win32_UserProfile | Select-Object LocalPath,SID,Special,Loaded
Get-LocalGroupMember -Group Users | Select-Object Name,PrincipalSourceA local account with a password, not a shared Microsoft account, is the cleanest split. Each person gets their own mail and browser profile inside their own session.
$pw = Read-Host -AsSecureString 'Password for the second user'
New-LocalUser -Name 'anna' -Password $pw -FullName 'Anna' -Description 'Second user'
Add-LocalGroupMember -Group Users -Member 'anna'
Get-LocalUser anna | Select-Object Name,Enabled,PasswordRequiredBoth daily accounts should be standard users. Elevation happens with the admin account's password, which keeps a mistake in one session from changing the machine for everyone.
Get-LocalGroupMember -Group Administrators | Select-Object Name
Remove-LocalGroupMember -Group Users -Member 'anna' -ErrorAction SilentlyContinue
Add-LocalGroupMember -Group Users -Member 'anna'
Get-LocalGroupMember -Group Users | Select-Object NameBy default each profile folder grants access to that user, Administrators and SYSTEM. A shared folder is the exception, not the rule.
icacls "C:\Users\anna"
icacls "C:\Users\bob"
Get-ChildItem C:\Users -Force | Select-Object Name,Mode
Get-SmbShare | Select-Object Name,Path**Fast user switching** keeps both sessions in memory. The sign-in screen lists both accounts, and each keeps its own desktop, apps and browser state.
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' | Select-Object HideFastUserSwitching,InactivityTimeoutSecs
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\UserSwitch' -ErrorAction SilentlyContinue | Select-Object EnableUserSwitch
Start-Process ms-settings:accountsPhotos and documents both need are better in a shared folder than duplicated. Put it in C:\Users\Public, which both accounts can already read and write.
New-Item -ItemType Directory 'C:\Users\Public\Shared' -Force | Out-Null
icacls 'C:\Users\Public\Shared' /grant 'Users:(OI)(CI)M'
icacls 'C:\Users\Public\Shared'
Get-ChildItem 'C:\Users\Public\Shared' | Select-Object NameThe profile is registered under a different SID. Check Win32_UserProfile and repair the ProfileList entry instead of the folder.
Both are signed in to the same work or school account. Use separate accounts, one per Windows user.
Fast user switching is disabled by policy or by limited memory. Check HideFastUserSwitching and close heavy apps.
It is still in the Administrators group. Remove it and keep one admin account for elevation.
No. Local accounts work and keep the profiles independent of any cloud sign-in.
Yes, each profile has its own browser data. A synced browser account is what merges them, not Windows.
Not through Explorer. An administrator can take ownership, which is why the admin password is the real boundary.
Remove the extra account with Remove-LocalUser anna; the profile folder stays in C:\Users until you delete it, and public files remain untouched.
Free · no account needed · tracks your progress