2.2 Given a scenario, configure and apply basic Microsoft Windows OS security settings.
📘CompTIA A+ Core 2 (220-1202)
Overview
Windows uses user privileges to control what actions a user or program is allowed to perform.
The two most important privilege levels you must understand for the exam are:
- Standard user
- Run as administrator (elevated privileges)
This topic is closely related to:
- User accounts
- Administrator permissions
- User Account Control (UAC)
- Principle of Least Privilege
CompTIA expects you to know when and why administrator privileges are required and why standard users are safer.
Standard User
What is a Standard User?
A standard user is a Windows account with limited permissions.
This is the default and recommended account type for everyday work.
What a Standard User CAN Do
A standard user can:
- Log in to Windows
- Run already-installed applications
- Access personal files and folders
- Change non-security settings (display, sound, language)
- Use network resources they have permission for
- Run applications that do not require system-level changes
What a Standard User CANNOT Do
A standard user cannot:
- Install or uninstall software that affects the whole system
- Modify system files or Windows folders (e.g.,
C:\Windows) - Change security settings (firewall, BitLocker, antivirus)
- Install device drivers
- Create or delete user accounts
- Change system-wide registry settings
If a standard user tries to do these tasks, Windows blocks the action.
Why Standard Users Are Important (Exam Point)
- Limits damage from malware
- Prevents accidental system changes
- Follows the Principle of Least Privilege
- Improves system stability and security
Exam Tip:
CompTIA prefers standard user accounts for daily work.
Run as Administrator
What Does “Run as Administrator” Mean?
Run as administrator means launching a program with elevated (administrator) privileges, even if the user is logged in as a standard user.
This does not permanently change the account type.
It only gives temporary admin permissions to that specific program.
How “Run as Administrator” Works
When you choose Run as administrator:
- Windows triggers User Account Control (UAC)
- UAC asks for:
- An administrator password (if logged in as a standard user), or
- Confirmation (if logged in as an administrator)
- If approved, the program runs with full system access
Tasks That Require “Run as Administrator”
Examples of IT-related tasks that require admin privileges:
- Installing or uninstalling software
- Installing printer or network drivers
- Modifying system services
- Editing system registry keys
- Running administrative command-line tools
- Applying system updates or patches
- Changing firewall or antivirus settings
User Account Control (UAC) and Administrator Privileges
What is UAC?
User Account Control (UAC) is a Windows security feature that:
- Prevents unauthorized system changes
- Prompts for approval before admin actions run
Why UAC Exists
Even administrators:
- Run programs as standard users by default
- Must approve actions that affect the system
This reduces:
- Malware infections
- Silent system changes
Exam Tip:
UAC prompts appear when a program requires administrator rights.
Administrator Account vs. Run as Administrator
| Feature | Standard User | Run as Administrator |
|---|---|---|
| Default permission level | Limited | Elevated (temporary) |
| Can change system settings | ❌ No | ✅ Yes |
| Requires UAC prompt | ❌ No | ✅ Yes |
| Safer for daily use | ✅ Yes | ❌ No |
| Used for maintenance tasks | ❌ No | ✅ Yes |
Why NOT Always Use Administrator Mode?
Running everything as administrator:
- Increases malware risk
- Allows programs to modify system files
- Can cause system instability
Best Practice (Exam Focus):
- Use standard user for daily work
- Use Run as administrator only when needed
This aligns with:
- Principle of Least Privilege
- Windows security best practices
Common Exam Scenarios
Scenario 1
A user cannot install software and receives a permission error.
Correct Answer:
Run the installer using Run as administrator.
Scenario 2
A company wants to reduce malware damage on employee PCs.
Correct Answer:
Use standard user accounts and allow admin access only when required.
Scenario 3
A technician needs to modify system services.
Correct Answer:
Launch the management tool using Run as administrator.
Key Exam Points to Remember
- Standard users have limited permissions
- Administrator privileges are required for system-level changes
- Run as administrator provides temporary elevated access
- UAC protects the system by requiring approval
- Daily work should be done as a standard user
- Always follow the Principle of Least Privilege
Summary (For Quick Revision)
- Standard user = safer, limited access, daily use
- Run as administrator = elevated access, temporary, maintenance tasks
- UAC controls and monitors admin actions
- CompTIA focuses on security and best practices
