User acct security privledges: Is one's own User self acct recommended to have reduced privledges from (me) the offical Administrator acct, & SYSTEM?

Question

Win 7 system. Four named "Users": 1. "Authenticated Users" (whatever that means); 2. "SYSTEM"; 3. Administrator (me); 4. "Users (me)".

"SYSTEM" & "Administrator" have all privledges allowed. "Users (me)" only has the privledges of "Read & Execute", "List Folder Contents", and "Read" over drive C. User me does NOT have granted "Full Control", "Modify", or "Write" privledges allowed. I'm assuming these are default Win 7 settings?

I had an issue with a patched-in XP hard drive (now drive F) from my old system, now on my new Win 7 system that was only cleared up after I gave myself greater privledges over drive F, in contrast to reduced drive C privledges where I do 99% of my computer activities. Hidden file "thumbs.db" rebuilt itself, rendering pictures properly for Win 7 digestion, once I gained control over F drive, and issue was fixed. Should I step back now from security privledges? This is my computer alone, not shared.

I don't even see how else to log in, other than User me, and I'm not sure if log in is thru the official "Administrator" acct, or User me... I suspect User me. How I would switch to the offical "Admin" acct to do admin duties there is a bit of a puzzle.

Bottomline, is there a recommended security protocol to using your computer in a "stepped-down" fashion from that of Administrator, to better prevent a hijacked system via breach? Or if you are sole user, is it recommended, given the threat environment, to be using the computer with all privleges granted in the security tab? Where might I be directed to a Win 7 security privledges primer on settings and safe practices? The fact I have an older XP hard drive with all its older XP protocols... patched into my new Win 7 system is a bit of a curveball on this issue, I think.

I am behind a router firewall and Win 7 software firewall and have AV if that even matters here.

Answer 1

Your question seems to primarily cover filesystem ACLs.

On filesystem ACLs you must grant the privileges that a user needs to access the system. For a drive/folder where you store your data, granting full control is usually fine.

Unless your system is encrypted it is very easy to bypass filesystem acls by simply rebooting the system off linux disk or some other system that ignores the filesystem ACLs. So it doesn't make a lot of sense to worry about filesystem ACLs on a single user system's data folders without encryption since they are very easy to bypass

You should almost certainly not modify the ACLs on the standard Windows folders (c:\windows, c:\program files, c:\users). On recent versions of Windows those are set with appropriate ACLs.

But setting permissive filesystem ACLs doesn't mean that you should login as a user in the administrators group. The ACLs on the standard windows folders, registry and other objects generally attempt to prevent non admin users from trashing the system while it is running normally.

Answer 2

In Windows 7, you can pretty safely run as an administrator. You aren't actually logged in as an administrator, but Windows makes it easy to switch to administrator when necessary by using your current password. It is safer still to run as a user, but some tasks (eg. Control Panel) can be irritating when you have to type the administrator password several times.

I realise it doesn't apply to you, but I recently saw a Windows XP computer get badly infected by a malicious website. It only got in because the user was an administrator. In Windows XP and earlier, it is definitely recommended to not run as an administrator at all times.