Who may do what.
WHAT AN ACCOUNT IS
An identity on a machine or service, with its own settings and files.
WHY SEPARATE ACCOUNTS MATTER
Each person has their own files and settings Actions are attributable A problem affects one account
WHAT ADMINISTRATIVE RIGHTS ALLOW
Installing software Changing system settings Accessing other accounts' files
WHAT TO USE FOR DAILY WORK
A standard account, not an administrative one.
WHY
Anything that runs has the rights of the account running it.
A standard account contains the damage.
WHAT TO DO WHEN ADMINISTRATIVE RIGHTS ARE NEEDED
Elevate for that action, then return.
WHAT NOT TO DO
Share one account between people Use an administrative account for browsing and email
WHAT TO SET
A password on every account A screen lock with a short timeout
WHAT TO REVIEW
Which accounts exist on shared machines.
WHAT TO REMOVE
Accounts for people who have left.
