Manage User Accounts
When you install Windows 10 on a new computer, the setup program creates a profile for one user account, which is an administrator account. (An administrator account is one that has full control over the computer.) Depending on what type of account you select during setup, that initial account can be either a Microsoft account or a local user account. If you upgrade to Windows 10 from Windows 7 or Windows 8 and you had local accounts set up in your previous operating system, Windows migrates those accounts to your Windows 10 installation. Local user accounts that you migrate from Windows 7 or 8 maintain their group memberships and passwords.
Through Accounts in Settings, Windows provides a simple post-setup method for creating new accounts and making routine changes to existing accounts. When you launch Accounts in Settings, you'll see a window.
You'll find different options and settings in Accounts depending on the type of account you use (Microsoft account or local account), whether your account is a member of the Administrators group, and-if your computer is joined to a domain-group policies in effect. In a domain environment, all management of user accounts beyond basic tasks such as selecting a picture is normally handled at the domain level.
And, because the transition from the old-school Control Panel to the modern Settings app is not complete, you'll find that some account-related settings can be made only with User Accounts in Control Panel.
Microsoft account vs. local account
A Microsoft account is an online account system that can enhance security of your computer and its data, foster easy synchronization between computers, and enable many online services (such as OneDrive, Cortana, and Skype) as well as access to the Windows Store. Under various names (most recently, Windows Live ID), Microsoft accounts have been around for years. If you've registered for Microsoft services such as Hotmail, Xbox Live, or Zune, you already have a Microsoft account. If you have an email address that ends with msn.com, hotmail.com, live.com, or outlook.com, you have a Microsoft account. However, you do not need a Microsoft address to create a Microsoft account; you can set up a Microsoft account using an existing email address from any domain and any email provider.
A local account is one that stores its sign-in credentials and other account data on your PC. This type of account has been the standard in Windows for decades. A local account works only on a single computer.
Note:
A third type of account, a work account using Azure Active Directory or Windows Server Active Directory, stores account information on a network server. It offers many of the advantages of a Microsoft account, subject to restrictions imposed by the network administrator. These accounts are more common in large businesses and schools.
Beginning with Windows 8 and continuing in Windows 10, Microsoft recommends the use of a Microsoft account rather than a local user account. It's not a requirement, however; local accounts are still fully supported.
- You can synchronize PC settings between multiple computers. If you use more than one PC-say, a desktop PC at work, a different desktop at home, a laptop for travel,
and a tablet around the house-the ability to sync allows your settings to apply to all your computers. Settings include things like your desktop colors and background,
your stored passwords, browser favorites and history, your account picture, your accessibility configuration, and so on. The synchronization happens automatically and
nearly instantly.
To view or modify your synchronization settings, open Settings and click or tap Accounts, Sync Your Settings. You can disable synchronization altogether (turn Sync Settings off) or you can turn individual settings on or off. - You can use OneDrive cloud storage and gain access to your data from any computer.
- You can download modern apps using the Store app. Without a Microsoft account, you can browse in the Store, but you cannot download apps, music, or videos.
- Some features in preinstalled modern apps require the use of a Microsoft account.
- Cortana, the personal assistant that's part of Windows 10, is available only when you sign in with a Microsoft account.
- With built-in two-factor authentication, a Microsoft account provides security for your PC and its data.
Note:
It is possible to use OneDrive, make Store purchases, and use some other apps that depend on a Microsoft account even if you sign in with a local account. However, you must sign in to each app individually, and some features might be unavailable or, at a minimum, less convenient to use.
Are there any reasons not to use a Microsoft account?
- If you sign in using your Microsoft account password (rather than using a PIN or Windows Hello, your password might be stolen. This could happen if someone is watching over your shoulder as you sign in, for example. Armed with your Microsoft account ID and password, a thief has access to much of your online life. (The moral here, of course, is not to eschew Microsoft accounts; rather, use a sign-in method that uses two-factor authentication and doesn't expose your password.)
- If your home network includes computers running Windows 7 or earlier (that is, versions that do not support the use of Microsoft accounts), connecting to shared resources can be more complicated.
- Some folks have privacy and data security concerns about storing personal information on the servers of a large corporation, whether it be Microsoft, Google, Apple, Amazon, or others. Microsoft has implemented a single privacy statement that covers most of its consumer products and services. For information about the privacy policy and to make choices about how Microsoft uses your data, visit account.microsoft.com/privacy.
You can switch between using a Microsoft account and a local account by going to Settings, Accounts. On the Your Account page, click Sign In With A Local Account Instead. Windows then leads you through a few simple steps to create a local account, which you'll then use for signing in. If you're already using a local account, the link reads Sign In With A Microsoft Account Instead. A few screens later, you're connected to an existing Microsoft account or a new one you create.
Configuring privacy options
These days, you don't need to be a conspiracy theorist to be concerned about privacy. Some companies abuse your trust by taking your information-often without your knowledge or consent-and sharing it with others who hope to profit from that information. Because Windows 10 is tightly integrated with cloud services (meaning some of your information gets stored on Microsoft-owned servers), and because Microsoft acknowledges using some of your information to provide better service (for example, Windows collects information from your calendar so that Cortana can make better suggestions), some people have privacy concerns about Windows.
But Microsoft is forthcoming about the types of information it collects and, more importantly, what it does with that information. Here, for example, is part of the privacy statement regarding advertising:
The ads we select may be based on your current location, search query, or the content you are viewing. Other ads are targeted based on your likely interests or other information that we learn about you over time using demographic data, search queries, interests and favorites, usage data, and location data-which we refer to as "interest-based advertising" in this statement. Microsoft does not use what you say in email, chat, video calls or voice mail, or your documents, photos or other personal files to target ads to you.
More important still, Windows includes a raft of options for controlling your privacy. You'll find them in Settings, Privacy, shown next. Here you can specify which apps are allowed to use each of your computer's many devices, whether to disclose your location, whether to let Cortana better know your voice and word pronunciations, and so on. You should examine each of these options carefully and decide for yourself where the proper balance is between your personal privacy and convenience.
On each page in Settings, Privacy, you'll find a link to the Microsoft privacy statement and links to additional information as well as the controls for making settings. The privacy statement is detailed yet clearly written, and it is an important aid for deciding which options to enable.
Changing account settings
With options in Settings and Control Panel, you can make changes to your own account or another user's account.
To change your own account, open Settings, Accounts to open the Your Account page. If you start at User Accounts in Control Panel, click Make Changes To My Account In PC Settings to reach the same destination.
Access the Your Account page quickly
You can jump straight to the Your Account page in Accounts without going through Control Panel or Settings. Simply open the Start menu, click or tap the account picture in the upper left corner of the Start menu, and choose Change Account Settings.
On the Your Account page, you can change your account picture, either by browsing for a picture file or by using your computer's built-in camera to take a picture. If you sign in with a Microsoft account, the Manage My Microsoft Account link opens your default web browser and loads your account page at account.microsoft.com. On that page, you can change your password or the name associated with your Microsoft account. Click other tabs along the top of the page to review your subscriptions and Store purchases, change your payment options, get information about all PCs and other devices associated with your Microsoft account, set privacy options, and more.
If you have added one or more users to your computer, you (as a computer administrator) can make changes to the account of each of those users.
To change a user's account type, in Settings, click Accounts, Family & Other Users. Then click the name of the account you want to change and click Change Account Type.
If the person signs in with a Microsoft account, there are no other changes you can make. (You can't make changes to someone else's Microsoft account at account.microsoft.com.) For users who sign in with a local user account, you can make a few additional changes, but you must start from User Accounts in Control Panel. Click Manage Another Account, and then click the name of the account you want to change. You can make the following changes:
- Account Name
The name you're changing here is the full name, which is the one that appears on the sign-in screen, on the Start menu, and in User Accounts. - Password
You can create a password and store a hint that provides a reminder for a forgotten password. If the account is already password protected, User Accounts allows you to change the password or remove the password. - Account Type
Your choices here are the same as in Settings, Accounts: Administrator (which adds the account to the Administrators group) or Standard User (which adds the account to the Users group).
If you use a local user account, you can make the following additional changes to your own account (that is, the one with which you're currently signed in) by clicking links in the left pane:
- Manage Your Credentials
This link opens Credential Manager, which lets you manage stored credentials that you use to access network resources and websites. - Create A Password Reset Disk
This link launches the Forgotten Password Wizard, from which you can create a password reset tool on removable media. - Manage Your File Encryption Certificates
This link opens a wizard that you can use to create and manage certificates that enable the use of Encrypting File System (EFS). EFS, which is available only in Pro and Enterprise editions of Windows 10, is a method of encrypting folders and files so that they can be used only by someone who has the appropriate credentials. - Configure Advanced User Profile Properties
This link is used to switch your profile between a local profile (one that is stored on the local computer) and a roaming profile (one that is stored on a network server in a domain environment). With a local profile, you end up with a different profile on each computer you use, whereas a roaming profile is the same regardless of which computer you use to sign in to the network. Roaming profiles require a domain network based on Windows Server. To work with user profiles other than your own, in Control Panel open System and click Advanced System Settings; on the Advanced tab, click Settings under User Profiles. - Change My Environment Variables
Of interest primarily to programmers, this link opens a dialog box in which you can create and edit environment variables that are available only to your user account; in addition, you can view system environment variables, which are available to all accounts.
Deleting an account
You can delete any account except one that is currently signed in. To delete an account, in Settings, Accounts, click Family & Other Users, and click the name of the account you want to delete. Then click Remove. Windows then warns about the consequences of deleting an account.
Note:
User Accounts won't let you delete the last local account on the computer, even if you're signed in using the account named Administrator. This limitation helps to enforce the sound security practice of using an account other than Administrator for your everyday computing.
After you delete an account, of course, that user can no longer sign in. Deleting an account also has another effect you should be aware of: you cannot restore access to resources that are currently shared with the user simply by re-creating the account. This includes files shared with the user and the user's encrypted files, personal certificates, and stored passwords for websites and network resources. That's because those permissions are linked to the user's original security identifier (SID)-not the user name. Even if you create a new account with the same name, password, and so on, it will have a new SID, which will not gain access to anything that was restricted to the original user account.
Delete an account without deleting its data
Earlier versions of Windows included an option for preserving an account's data files-documents, photos, music, downloads, and so on stored in the user's profile-when you delete the user account. Windows 10 offers that option too, but you won't find it in Settings. Instead, open User Accounts in Control Panel. Click Manage Another Account, click the account you want to remove, and then click Delete The Account.
User Accounts gives you a choice about what to do with the account's files:
- Delete Files
After you select Delete Files and confirm your intention in the next window, Windows deletes the account, its user profile, and all files associated with the account, including those in its Contacts, Desktop, Documents, Downloads, Favorites, Links, Music, Pictures, Saved Games, Searches, and Videos folders.- Keep Files
Windows copies certain parts of the user's profile-specifically, files and folders stored on the desktop and in the Documents, Favorites, Music, Pictures, and Videos folders-to a folder on your desktop, where they become part of your profile and remain under your control. The rest of the user profile, such as email messages and other data stored in the AppData folder; files stored in the Contacts, Downloads, Saved Games, and Searches folders; and settings stored in the registry are deleted after you confirm your intention in the next window that appears.