User Account Management
You might have noticed a common theme running through the section on Windows security in this tutorial, that being that users can, and often annoyingly do, deactivate crucial security systems on their PCs because they "find them annoying," "they slow down the PC," which isn't true, or they stop the user "from doing what [they] want," which is very often the whole point, as if the user wants to do something that's blocked by Windows' security systems, it's very likely they shouldn't be doing it anyway.
When it comes to user accounts, it's important to create them in ways that constrain the user to do only what they ought to be doing, and not necessarily what they want to be doing. It might be difficult to prevent a user from spending time on Facebook or eBay, or from playing Minecraft (though these are fairly innocuous activities that are unlikely to jeopardize the security of the PC), allowing a user access to file-sharing, adult, or gambling websites (where malware can often hide), or permitting them to install their own apps and utilities on a PC, which does present a serious potential security risk and therefore a serious risk to the stability and operation of the PC and the integrity of its files and the data stored on both it and elsewhere on your network.
Remember that PCs no longer operate in isolation, not even in the home. Malware infecting a PC can quickly spread across the network, affecting other PCs, and even servers and network hardware and storage, and the result can be expensive downtime or even the opening of backdoors into company data that can result in an embarrassing and extremely costly data breach.
Administrators vs. Standard Users
Back in the days of Windows XP, every new user was an Administrator, even the Standard users to a certain extent, because there was no UAC feature to prevent unwanted changes being made to a PC. Administrators can change anything on a PC, anything at all. They can install new software, modify configuration settings, and even delete files in the \Windows operating system folder.
Standard users on the other hand can only make changes that affect their own user account, and nobody else's. This can have some downsides in the workplace, especially if a user does need to install the odd extra piece of software (all users can install apps from the Microsoft and Windows Business stores), but it's generally accepted that there should be just one Administrator on a PC (usually the person who knows what they're doing) and that everybody else should be a Standard user.
Local Accounts vs. Microsoft Accounts
If you are using PCs in the workplace, you'll most likely have users set up on PCs using Domain or Azure Active Directory accounts managed by a Windows Server system. Smaller businesses might have users signed into PCs using a Microsoft 365 account, but for everybody else it's the choice between using a Microsoft account to sign into a PC or a local account.
While it is still technically possible to install Windows with a local account (make sure the PC is disconnected from the Internet at the time of installation). Microsoft wants everybody using a Microsoft account because that's what offers the "best experience" and Windows 10 will try, and likely succeed in forcing you to switch to a Microsoft account instead. List the pros and cons using Microsoft and local accounts on a Windows 10 PC (Tables).
Table: The pros and cons of using a local account
Local Account
Pros Cons No personal data is shared Syncing of personalization and Ease of Access with Microsoft settings is not supported No files are stored in the Windows Store cannot be used without Microsoft cloud unless you deliberately account sign-in set it up OneDrive file sync is not supported without Microsoft account sign-in Setup and configuration can take much longer After a reinstall
Table: The pros and cons of using a Microsoft account
Microsoft Account
Pros Cons You get the full Windows 10 Personal advertising data is shared with experience with all features Microsoft unless you opt out during or supported and working after installation Profile sync across your Integration is built into Microsoft Windows 10 devices (PCs, services you may not wish to use laptops, tablets, smartphones) including personalization and Ease of Access options File backup and sync between PCs are possible using OneDrive Setup and configuration is partly handled automatically after a reinstall
User Identity and Sign-In Management
Windows 10 supports many more ways for a user to sign into a PC than just by using a password, but this isn't always a good thing. These additional sign-in methods include picture passwords, where you draw shapes over a picture (fairly pointless but useful for children perhaps); a PIN, such as the one you use for your bank card at an ATM; and Windows Hello, which supports several forms of biometric sign-in from fingerprint readers to iris and facial recognition.
How to Create a Superstrong Password
It is always a good idea to use a password manager, though the main web browsers such as Chrome and Edge have excellent password managers built-in that can sync across desktop and mobile platforms. If you don't use a dedicated password manager however, these are my top tips for creating superstrong passwords for use on your PC and with websites and Internet services:
- Create passwords that are a bare minimum of 12 characters in length.
- Always use a mixture of numbers, uppercase letters, lowercase letters, and symbols.
- Substitute some letters and numbers for other characters. For example, you can use a 5 instead of an s or S; an & instead of a or A; () instead of o, O, or 0; and / instead of the number 7.
- Use a phrase, perhaps a line from a song or poem, instead of a single word to make the password longer.
- Append some unique characters representing the service or website the password is for to the beginning or end of the password to make it unique to that service or website. For example, use ebA for eBay, aMa for Amazon, or g()() for Google web services.
- Choose a format you will use for each word in your password, for example, capitalizing the second letter of each word and substituting the first vowel with a symbol.
An Introduction to Family Safety
While we're on the subject of preventing users from doing things that can adversely affect the security of the PC, it's worth finishing up by talking about children. If you have children, then you also have my sympathies, because you'll be all too aware that especially younger children have almost no idea of what constitutes a risk, either in the playground or on the Internet.
Windows 10 does include Family Safety features, and when you add a new user to the PC, you'll be asked if they are a family member or somebody else. The former option then lets you choose if the person is a child or an adult. Child accounts are automatically hooked into the Family Safety features, which include website filtering, game ratings management, and usage time management for the PC.
For the purposes of maintaining security, it's the website filtering that's the most useful. This can prevent children from accessing adult, file-sharing, or gambling websites where malware is often found.
Note: It's worth mentioning that no Family Safety or Child Protection feature, be they from Microsoft, from a third party, or managed by your Internet Service Provider (ISP), can't guarantee to block every attempt by a child to access content that you consider inappropriate. Thus, it is important to maintain good communication with your child on how they can keep themselves safe online, and why it is important for them to do so.
Managing and Deleting User Accounts
User accounts are managed in Windows 10's Settings app. There's really not much else you can do with them in the Control Panel. If you have a user set up on a PC that's an Administrator when they should really be a Standard user, you can change their account type in Accounts and Family & other people. Note that you need to be signed in as an Administrator to do this.
Sometimes, though, you will want to remove a user from a PC. Clicking in their account name in the Settings app will reveal a Remove button. Bear in mind though that removing an account will delete their user folders from the PC, including any files and documents they have created and stored. Always make sure files are fully backed up before performing this action!
Caution: Deleting user accounts and their files does NOT securely delete the files and data, which can still be recovered through the use of file recovery apps. To securely wipe currently unused space on your PC, you will need a third-party tool such as CCleaner from piriform.com. You can also wipe the free space on your PC by opening the Command Prompt (Admin) from the Win + X menu and typing cipher /w:[directory name or drive letter].