Manage User Accounts and Settings in Windows 10

Computers have become an integral part of our lives. We store personal and business information on them, and use them to access financial and social information online. That information might be protected by a password, but the password could easily be accessible to any other person who is using your computer. To protect your privacy and the integrity of your information, it is important to control who can sign in to your computer or tablet, and what they can do when they’re signed in.

Computer access is managed through user accounts. Each individual user of a computer, regardless of age, should sign in with his or her own account. Each user account has access to a private file storage area and user interface customizations, and to a shared public file storage area. Accounts designated as Child accounts have additional safeguards that are designed to protect them from content that isn’t age appropriate.

When you sign in to your computer, you have a myriad of options available for doing so. User accounts can be protected by passwords, but users can choose alternative sign-in credentials such as PINs, picture passwords, and biometric identification.

This chapter guides you through procedures related to creating and managing user accounts, managing account pictures and passwords, and customizing your sign-in options.

Understand user accounts and permissions

Windows 10 requires at least one user account. You specify that account when you’re completing the installation processes, or the first time the computer starts after Windows 10 has been installed. Windows 10 designates this first account as an administrator account so that the account can be used to manage the computer. It isn’t possible to sign on to the computer without a user account.

There are a lot of uses of the word “user” and “account” in this book, and particularly in this chapter. Here’s a summary of the uses of those terms:

• A user is the person who is using the computer.
• A user account is an account that a person uses to sign in to a computer.

Each user account is either:

• A Microsoft account, which is any email address that has been registered with the Microsoft account service
• A local account that exists only on a single computer and is not associated with a specific email address

You can use your Microsoft account to sign in to multiple computers, websites, and services by using the same email address and password. Signing in with your Microsoft account credentials allows you to share settings and files among all your devices. Any device you sign in to with this account can have access to the same settings and information. Signing in with a local account places limits on the applications you can purchase or download from the Store, and might limit your access to OneDrive. Because almost any email account can also be set up to be a Microsoft account, it’s a good idea to take advantage of the extra benefits that allows.

Every user account is also classified as either:

• An Administrator account
• A Standard User account

This classification provides a specific level of permission to manage system actions on the computer. We explain what each of these types of accounts can do in the next section of this topic.

A user account can also be one of the following:

• A Child account that is monitored by using Family Safety
• An Adult account that can manage Family Safety settings for Child accounts

These are optional designations that make the user account holder part of your family group. We explain family safety in the sidebar “Manage and monitor family safety settings” later in this chapter.

Important

The information in this chapter applies to computer user accounts (sometimes referred to as local user accounts) and not to network domain user accounts.

User profiles

Windows provides the ability to share one computer among multiple users, or for one user to have multiple accounts for different purposes. To do this, each user account (whether a Microsoft account or a local account) is associated with a user profile that describes the way the computer environment (the user interface) looks and operates for that user. This information includes simple things such as the desktop background, desktop content, and Windows color scheme. It also includes personal and confidential information, such as saved passwords and your Internet browsing history.

Each user profile includes a personal folder that is not generally accessible by other people who are using the computer, in which you can store documents, pictures, media, and other files that you want to keep private.

The Windows 10 system of user profiles allows more than one person to use the same computer while providing the following safeguards:

• Each user’s information is stored separately You prevent Standard Users from reading or altering your documents, pictures, music, and other files by storing them in subfolders that are automatically set up within your user account folder. For example, if you manage your family’s financial records on a home computer that your children use to do their homework, the children log in with separate accounts and don’t have access to confidential information or the ability to change your files. Administrators can access all user accounts.
• Each user’s working environment is protected You can personalize your environment in various ways, without worrying about other people making changes to your personal settings.
• Each user’s app usage is unique Each user runs separate instances of each app on the computer. For example, you can set up Outlook to connect to your accounts, and other computer users can set up Outlook to connect to their accounts, but they cannot also connect to your accounts. Each user’s data is stored and managed separately.

User account permissions

The system actions that a user can perform are governed by the type of account he or she signs in with. An administrator account has higher-level permissions than a standard user account, which means that an administrator account owner can perform tasks on your computer that a standard user account owner cannot.

Standard user account credentials allow a user to do things that affect only his or her account, including:

• Change or remove the password.
• Change the user account picture.
• Change the theme and desktop settings.
• View files stored in his or her personal folders and files in the Public folders.

Administrator account credentials are necessary to do things such as:

• Create, change, and delete accounts.
• Change settings that affect all of the computer’s users.
• Change security-related settings.
• Install and remove apps.
• Access system files and files in other user account profiles.

Tasks that require administrator permission are indicated in windows and dialog boxes by a Windows security icon.

The Windows security icon is shaped like a shield

If you have an administrator account—even if you’re the only person who will be using your computer—it’s a good idea to create and use a standard user account for your day-to-day computing. There is a much higher risk of serious damage to a computer system if malware infiltrates your computer (or a malicious person gains control of it) when you’re signed in as an administrator than there is when you’re signed in as a standard user. Through an administrator account, the person or app has access to all system files and settings, whereas a standard user account doesn’t have access to certain functions that can permanently damage the system.

Family accounts

Many children use computers for educational or entertainment purposes. Each child should have a unique Microsoft account that you designate as a Child account. For each Child account, you (and other adults you designate as family members) can do the following:

• Monitor web browsing history, app use, and game use.
• Block websites that contain adult content, or allow young children to visit only specific websites.
• Restrict the usage of apps and games to only those that meet specific age ratings.
• Monitor screen time, and restrict computer usage to only specific times or to a specific number of hours per day.
• Manage payment options and monitor purchases in the Windows Store and Xbox Store.

You can monitor children’s activity on every computer or device they sign in to with their Microsoft accounts.

You can check on your child’s recent computer usage on the Family page of your Microsoft account website (at account.microsoft.com) at any time, and you can opt to receive weekly reports summarizing your child’s computer use.

See Also

For more information about monitoring and managing children’s computer activity, see the sidebar “Manage and monitor family safety settings” later in this chapter.

User Account Control

User Account Control (UAC) protects your computer from changes to Windows system settings by requiring that an administrator expressly permit certain types of changes. Each area of the Windows interface that requires administrator permission is labeled with a security icon. When you attempt to access or change protected Windows settings, a User Account Control dialog box appears, asking for confirmation that Windows should continue the operation.

The User Account Control message box varies depending on your account and the action

If you’re signed in with an administrator account, you can simply click the Yes button to continue the operation. If you’re signed in with a standard user account, the message box displays a list of the administrator accounts on the computer. To continue the operation, you click one of the administrator accounts, enter its password in the box that appears, and then click Yes.

TIP

If an administrator account doesn’t have an associated password, you can continue the operation by simply clicking that account and then clicking Yes. This is one of the reasons that it’s important that each administrator account on the computer has a password.

Windows doesn’t save the credentials you enter in the User Account Control message box; they are valid for this operation only. Anyone who doesn’t have access to administrator credentials can’t perform the operation, which effectively prevents non-administrators from making changes you haven’t authorized.

UAC has four levels of control. Only the first two are available when you’re signed in with a standard user account, even if you have access to administrator credentials:

• Always notify me This is the default setting for a Standard User account. When a user or app initiates a change that requires administrator credentials, the desktop dims and the User Account Control message box opens. You must respond to the message box before you can take any other action.
• Notify me only when apps try to make changes to my computer This is the default setting for an Administrator account. When an app initiates a change that requires administrator credentials, the desktop dims and the User Account Control message box opens. You must respond to the dialog box before you can continue.
• Notify me only when apps try to make changes to my computer (do not dim my desktop) When an app initiates a restricted action, the User Account Control message box opens. The restricted action will not be performed until you respond to the dialog box, but you can perform other tasks while the message box is open.
• Never notify me This is the equivalent of turning off UAC. Any user or app can make any changes to the computer without restriction.

With the default setting, Windows 10 prompts for administrator credentials when a user or app initiates an action that will modify system files. There’s not a lot of reason to change the User Account Control setting, but you can.

To change the User Account Control setting

1. On the taskbar or in the Settings window, enter UAC in the search box and then, in the search results list, click User Account Control Settings.

   TIP

   

   The security icon to the left of the command indicates that administrator credentials are required to complete this operation.

   The User Account Control Settings window opens.

   

   Click to view larger image

   You can select from four levels of change control

2. Click above or below the slider, or drag it, to set UAC to the level you want, and then click OK.

3. In the User Account Control message box that appears, enter administrator credentials if necessary, and then click OK.

   TIP

   

   You must be signed in with an administrator account to select either of the two lowest settings. If you select the Never Notify setting, you must restart your computer to complete the process of turning off UAC.