Probably a stupid question - but

[Faustus]

As title suggests but here goes nothing. I am puzzled by accounts and admin rights in Windows 10. Let me explain further. If as an example I right click documents > properties > security tab then I see the following. There are three separate entries with icons of people at the side of them.

The first icon looks like a man and a women and says 'system' - nothing listed against that.

The second icon is just a man and against that icon is my full name e.g. Joe Blogs followed by my MS account username which is an email address. This entry appears to have full permissions.

The third entry is a man and women icon again and against this is listed Administrators then in brackets (Joe Blogs PC\Administrators) and again full permissions.

If I look in the profile list in the registry there is only the one entry C:\users\Joe Blogs PC.

I'm confused by the double entries i.e. my username and the computer username both with full permissions. Is this normal or has something gone awry here?

 

[Quartz]

Totally normal. You have your own account and the computer has its own account. Beyond that there are what are called groups, like the Administrators group. Groups contain users and it's easier and more useful to manage security with groups than with users. Imagine you shared you computer with your partner and your three children (NOT a good idea!). Each of you would have your own account, for five total, but you might create two groups, Adults and Children, with you and your partner members of the former and the children the members of the latter. You could then control access to folders on the HDD and applications by granting or denying permissions to those groups rather than each account individually, cutting the administration tasks by 60%.

Go to Control Panel, Admin Tools, Computer Management, Local Users and Groups, and tread VERY carefully.

This is a bit of a rabbit hole!

 

[Faustus]

Totally normal. You have your own account and the computer has its own account. Beyond that there are what are called groups, like the Administrators group. Groups contain users and it's easier and more useful to manage security with groups than with users. Imagine you shared you computer with your partner and your three children (NOT a good idea!). Each of you would have your own account, for five total, but you might create two groups, Adults and Children, with you and your partner members of the former and the children the members of the latter. You could then control access to folders on the HDD and applications by granting or denying permissions to those groups rather than each account individually, cutting the administration tasks by 60%.

Go to Control Panel, Admin Tools, Computer Management, Local Users and Groups, and tread VERY carefully.

This is a bit of a rabbit hole!

Ah! thanks for that helful reply. i had looked at my Windows 7 VM but that looked a bit different. As there's only the two of us using the computer which we share then there's no need to add further accounts. So the account with the email address is mine and the other belongs to the computer.

You do see arguments that is not a good idea security wise to use your full admin account and that you should sign in with a 'local account' instead.