← All articles

How to Remove Local Admin Rights From Windows Users

Remove local admin rights from Windows PCs without breaking software or locking yourself out. Audit, plan, remove and enforce least privilege, step by step.

IT administrator changing Windows account permissions

To remove local admin rights, first list who sits in the local Administrators group on each PC. Next, make sure at least one separate, protected admin account still exists. Then remove everyday users from the group and enforce that state centrally so it cannot drift back. On one machine this takes minutes. Across a business it takes a plan, because software installs, updates and support requests all depend on who can elevate.

This matters because a user who runs as administrator hands any attacker who reaches that session the same authority. One phishing click then becomes a network problem. The steps below cover the audit, the preparation, the commands, the fleet-wide enforcement and the controls that keep administrator access safe afterward.

247techify
247techify.com
Reduce Risk From Excess Admin Access
247Techify provides cybersecurity-first managed IT services for Canadian businesses seeking secure, efficient systems and support.
Explore managed IT services

TL;DR

  • Everyday accounts should be standard users. The Canadian Centre for Cyber Security advises giving users only the access their tasks require.
  • Audit first with Get-LocalGroupMember -Group 'Administrators', then confirm a separate, protected admin account exists before you remove anyone.
  • Removal is a single command or a few clicks per PC. Group membership is read at sign-in, so users must sign out before the change applies.
  • On more than a handful of devices, enforce membership through Group Policy or your device management platform. Manual cleanup drifts back.
  • Protect the remaining admin accounts with multi-factor authentication, separate logins and scheduled access reviews.

Table of Contents

Why everyday accounts should not be administrators

An administrator session can change security settings, install drivers and services, disable protection and read data belonging to other users. CISA’s guidance states that if a threat actor reaches a computer while the user is logged into an administrator account, they may have permission to access all data and device functions. It recommends a standard account for day-to-day work and downgrading general-purpose administrator accounts to user accounts.

The Canadian Centre for Cyber Security makes the same point for Canadian organizations. If threat actors gain access to an administrative account, they can affect the operating environment, disrupt network traffic and reach sensitive information. Its recommendation is to give each user the minimum access needed to complete their tasks.

The practical danger is quieter than a loud ransomware screen. Forrester’s analysis notes that an attacker who compromises an account with local admin rights can settle into that endpoint. From there they can run tools such as PowerShell, Command Prompt, WMI, rundll32.exe or remote desktop utilities that do not trigger normal detection policies. They can then probe slowly for other weaknesses. The attackers effectively have the keys, and they use tools that already belong on the machine.

Find out who has admin rights today

Do not remove anything until you know what exists. On a single Windows PC, open PowerShell and run:

Get-LocalGroupMember -Group 'Administrators'

This lists every member of the local Administrators group, as Microsoft’s PowerShell community documents. Expect to see the built-in administrator account, any domain or Microsoft Entra groups added by your setup, and usually the primary user. Anything you cannot explain is a finding. Unknown local accounts, former employees and old vendor logins are the most common surprises.

For a small office, record the result per device in a spreadsheet: machine name, member, who added it and why. For a larger fleet, run the same query remotely or through your management platform and export the output. The goal is a short list of accounts that truly need elevation and a longer list that does not.

Plan before you remove anything

Most failed rollouts do not fail on the command. They fail on what the command interrupts. Cover these five points first.

Keep one working administrator path

Before you remove any administrator, make sure another account you can sign in with still has administrator rights. Otherwise a routine cleanup becomes a lockout and a recovery job. A command-line reference also warns that the net localgroup command can fail with “System error 5: Access is denied” if the Command Prompt is not elevated, even when you are signed in as an administrator.

A GIAC paper on least privilege in small and mid-sized businesses states that at least one local administrator account must remain on each system. Best practice is to keep the built-in account disabled, or, if you activate it, rename it and give it a complex, unique password. The same paper describes Microsoft’s free Local Administrator Password Solution (LAPS), which assigns each workstation a randomized, regularly updated local administrator password. That means one stolen password cannot open every machine.

Inventory what actually needs elevation

The GIAC paper explains why the habit persists. Many programs written in the Windows XP era assumed a local administrator, so users were simply left as administrators of their own machines, and the practice remained common in small and mid-sized businesses long after. Expect a short list of legacy line-of-business applications, accounting add-ins, printer drivers and scanner utilities that behave badly as standard users.

Forrester observes that local admin rights have lingered largely because controlling application delivery, testing updates and maintaining application catalogs takes time. It also notes that the move to SaaS and web-based apps has reduced the need for them, except for letting users install whatever extras they choose. In most offices, that last point is what you are really taking away, and it is the part that protects you.

Decide how software gets installed

Once users cannot install software, someone must. Choose the route before launch day:

  • Approved applications deployed centrally by IT or your managed service provider.
  • A short request process with a same-day target for standard requests.
  • A named person who can approve and perform elevation for the exceptions.

If you skip this step, users will experience the change as a broken laptop and pressure will build to reverse it.

Test with a pilot group

Pick three to five users across different roles: someone in finance, someone who travels, someone who uses specialist software. Remove their rights, run for a week or two, and log every failure. Fix those with deployment packages or targeted permission changes, not by returning administrator rights.

Tell people what is changing

A two-paragraph notice avoids a flood of tickets. Explain that this is a security measure that applies to everyone, how to request software, and who to contact. Say plainly that nothing is wrong with their device.

Remove local admin rights on one PC

Three methods work on Windows 10 and 11. All need an elevated session from an account that keeps its administrator rights.

Using Local Users and Groups

Per Petri’s walkthrough, expand Local Users and Computers (Local), click Groups, double-click Administrators, select the user and click Remove. Affected users should log out for the change to take effect. This console is not available on Windows Home editions, where the command-line methods apply.

Using Command Prompt

Open Command Prompt as administrator and run:

net localgroup administrators username /delete

The account itself is not deleted, only its membership of the group, and a successful run returns “The command completed successfully,” according to the same command-line reference. The user’s files and profile are untouched.

Using PowerShell

The equivalent cmdlet is:

Remove-LocalGroupMember -Group "Administrators" -Member "username"

It belongs to the Microsoft.PowerShell.LocalAccounts module, present on Windows 10 and later. Use the -WhatIf parameter first to preview the change without applying it, especially when you script it across many machines.

Confirm the result

Group membership is built into a user’s access token at sign-in, so a signed-in user keeps their rights until they sign out or restart. After the change, ask the user to sign out, then rerun the Get-LocalGroupMember query and confirm the account is gone. Then try a protected action, such as installing a program, and confirm it now asks for administrator credentials.

Remove admin rights across many devices

Manual removal does not scale and does not last. Someone grants a temporary exception, a technician adds an account during a support call, and six months later the list is long again. For a business with more than a few PCs, enforce the membership you want instead of cleaning up after the fact.

There are two common routes, depending on how your devices are managed:

  1. Domain-joined PCs with Group Policy. A policy that defines the exact membership of the local Administrators group reapplies on each refresh. Anyone not on the approved list is removed automatically, including accounts added by hand.
  2. Cloud-managed PCs with Microsoft Intune. Endpoint security account protection policies can set local group membership on enrolled devices, so you can standardize who is an administrator without re-enrolling or resetting machines.

In both models the approved list should contain only your protected administrator account or groups, plus your IT provider’s access where one is contracted. Test the policy on the pilot group before applying it everywhere, and keep a written record of what the policy enforces.

For remote one-off fixes on a domain-joined machine, the PowerShell cmdlet can run against a named computer through Invoke-Command. Treat that as a repair tool, not a control. Policy is the control.

Keep the remaining admin accounts safe

Removing local rights from everyday users shrinks the target. The administrator accounts that remain become the valuable ones, so harden them.

The Canadian Centre for Cyber Security recommends several controls here. Create administrative accounts separate from users’ normal logins, and keep them away from the Internet and email. Use multi-factor authentication on every administrative account. Remove special access privileges when users no longer need them. Its guidance for small and medium organizations adds that administrator accounts should perform only administrative activities, never browsing or reading mail.

Five safeguards for remaining administrator accounts

In practice that gives you a simple rule: nobody reads email as an administrator. Staff who do IT work keep two identities, an ordinary one for daily use and an admin one used only to elevate. Add multi-factor authentication for administrators, and hardware-backed methods where you can, so a stolen password alone achieves nothing. If your team uses Microsoft 365, our guide to MFA for Microsoft 365 admins covers the rollout without lockouts, and conditional access policies let you restrict where admin sign-ins can come from. Distributed teams should also review the security features of remote work tools they rely on.

One more principle from Cybersecurity Canada’s access control guidance: avoid permanent elevated access. Grant administrative access only when it is needed and revoke it when the task is complete. Apply least privilege to applications and services too, not only to people.

Make it stick with regular reviews

Least privilege is a habit, not a project. The same Cybersecurity Canada control recommends reviewing privileged accounts at least quarterly and standard accounts at least semi-annually. Each review should involve a manager, be documented, remove stale access and flag dormant accounts, for example those unused for 90 days, for investigation.

A workable routine for a small business:

  • Each quarter, re-run the local administrator audit on every device and compare it with the approved list.
  • When an employee leaves or changes role, remove access the same day.
  • Log every temporary elevation with a reason and an end date.
  • After any security incident, review administrator membership first.

Common problems after removal

An application stops working. Identify what it writes to, usually a protected folder or the registry. Fix it by deploying the application centrally or adjusting permissions on that specific location. Do not restore the user to the Administrators group.

Users cannot change the time zone, install a printer or connect to a new Wi-Fi network. These everyday tasks are normally allowed for standard users in current Windows. If one is blocked, check for a restrictive policy rather than assuming administrator rights are required.

Common problems after removal

The user still has admin rights after removal. They have not signed out. Their old token stays valid until they do.

Someone is locked out of all admin functions. This is why you verified a working administrator path beforehand. Use your protected admin account or recover through your managed provider.

Our view: privilege removal works best as a managed service

We see the same pattern in small and regulated businesses across the GTA: everyone is an administrator because it was the easy default years ago, and nobody owns the cleanup. We approach it as part of a cybersecurity-first managed IT service, not a one-off script. That means auditing every endpoint, deploying approved software centrally, enforcing standard-user membership by policy and putting the remaining admin accounts behind multi-factor authentication.

For healthcare, finance and legal practices, restricting privileges is also part of showing control over who can reach sensitive data, which frameworks such as HIPAA and PCI-DSS expect organizations to be able to demonstrate. Our technicians are Microsoft-certified, and our support is designed to respond in under 30 minutes, so the elevation requests that follow a rollout get handled before they turn into workarounds.

The sequence matters more than the tooling. Audit, protect the break-glass account, pilot, enforce, review. If you are unsure which of your machines carry unnecessary rights, that audit is the right first step.

247techify Team

Let us handle the rollout

If you would rather not run the audit, pilot and enforcement yourself, our managed IT plans include endpoint protection, device management, Microsoft 365 management and 24/7 helpdesk support. Business managed IT is listed at $1,099 to $2,499 CAD per month on our GTA managed IT price index. For one-off help, pay-per-ticket support is $79 per ticket, and all current options are on our pricing page.

247techify

If your concern is the wider attack surface, our cybersecurity services include managed detection and response and penetration testing. Toronto businesses can also see how we work locally on our managed IT services in Toronto page.

FAQ

How do I check if my user has admin rights?

Open PowerShell and run Get-LocalGroupMember -Group 'Administrators'. If your account name appears in the list, directly or through a group, you have local administrator rights. Standard users will see a prompt for administrator credentials when they try to install software or change system settings.

Does removing a user from the Administrators group delete their account?

No. Only the group membership is removed. The account, its files and its profile stay as they were. The user keeps current administrator rights until they sign out or restart, then signs back in with standard permissions.

Can I remove admin rights on a computer if I am the only administrator?

Not safely. Create or confirm a second administrator account first, ideally a separate one used only for administration, with a strong unique password. Removing the last administrator can force a lengthy recovery process.

Will removing admin rights stop employees from doing their jobs?

Not when it is planned. Most daily work in browsers, Microsoft 365 and SaaS tools needs no administrator rights. The exceptions are usually older line-of-business software, which can be deployed centrally or given targeted permissions during a pilot.

How often should I review who has admin access?

Cybersecurity Canada’s access control guidance suggests reviewing privileged accounts at least quarterly and standard accounts at least semi-annually. Also remove access the day someone leaves or changes role.

Sources