Windows 10 Accounts Setup

I am using Windows 10 Pro 64bit Ver.19042.928

I have a PC with an Admin account and a local Account, but obviously when I try to make any change to the local account it asks me for the Admin account and password, which is fine if it's just my PC, but I have to deploy new company PC's that have an Admin account so I can always login even if the user messes things up, but I also want the user to add printers, install software etc, but I don't want them to have the Admin account details, so how can I give them the access they need without making them an Admin or giving them Admin details

Can this be controlled by Group Policy or a different level of Admin rights, or did Microsoft not think about this problem

Hi Denis

Thanks for your reply.

We are coming from an environment controlled by a Domain Controller and I agree that this would have been the way to go, but the new environment is run in the Cloud, so there will be no Domain Controller, just an Admin Windows account and a User account, so based on your reply we either give the user account Admin rights or we install all the Apps, Printers etc on the user account.

Steve

Excuse me for my ignorance because both of you are much more knowledgeable than I am.
Couldn't you do a remote login with a program like GoToMyPC and do the admin tasks that way?
I have known people that have to do things like that for clients that are scattered far apart and this saves a lot of driving.

The PC's already have TeamViewer installed, but this is just for remote support when they have a problem, it is counter productive to have Support remote in every time they want to do something they should be able to do themselves, hence the reason for asking if it was possible to give a user enough admin rights to do this, but not enough to access the Admin account and certainly not to be able to change the main Admin account password or indeed their own.

Steveh24 said:

The PC's already have TeamViewer installed, but this is just for remote support when they have a problem, it is counter productive to have Support remote in every time they want to do something they should be able to do themselves, hence the reason for asking if it was possible to give a user enough admin rights to do this, but not enough to access the Admin account and certainly not to be able to change the main Admin account password or indeed their own.

In that case what about giving each user a second account with Admin privileges. The user would use their regular account for normal work and the Admin account only as needed.

This is where my original question came from, I want each PC to have an Admin account that only the Support people know, so that should anything happen to the User account, Support can login to the Admin account and correct it all.

So far the best solution is to make an image of the PC so that the User account has Admin rights, then if the Admin account is messed up all we have to do is restore the image.