4.10 Adding more users to the PC.
Windows 10 enables you to set up a new outlook.com, hotmail.com, or live.com e-mail address, or an e-mail address for your own domain. Enter an e-mail address and wait for Windows to validate it as shown in Figure 4.11.
Figure 4.11 Successful validation.
Now that you have validated the e-mail, you can begin to set up the user account. Click the Work access link on the left of the Accounts page and click the Connect button on the right. Enter the e-mail address associated with the account that was just validated and then click Continue. Windows 10 then connects to your server or organization on the Internet or local network and begins to set up the user account on the computer automatically.
Local accounts are useful when you do not need to keep computers synced. When you use local accounts, you set up accounts for each user that will be using a computer as a stand-alone user. If you need to set up one account that can be used on multiple Windows 10 computers, you must set up Microsoft accounts or domain accounts.
Local accounts are also limiting in that you cannot use them to access the Windows Store to download apps, or services like SkyDrive. Remember that to access Windows Store apps, you must set up and use a Microsoft account.
A single user account named Administrator is built into Windows 10. This is not the same as an administrative account you create yourself or see on the login screen. This account is hidden from normal view. It doesn't show up on the usual login screen.
The built-in Administrator account has unlimited computer privileges. So, while you're logged in to that account, you can do anything and everything you want with the computer. Any programs you run while you are in that account can also do anything they want. That makes the account risky from a security standpoint, and very unwise to use unless absolutely necessary.
In high-security settings, a new computer is usually configured by a certified network or security administrator who logs in to the Administrator account to set up the computer for other users. There, the administrator configures accounts on the principle of least privilege, where each account is given only as much privilege as necessary to perform a specific job.
When the administrator is finished, he or she typically renames the built-in Administrator account and password-protects it to keep everyone else out. The account is always hidden from view, except from other administrators who know how to find it. All this is standard operating procedure in secure computing environments, although hardly the norm in home computing.
In Windows 10, you really don't need to find, log in to, and use the built-in Administrator account unless you're an advanced user with a specific need, in which case you can get to it through Safe Mode. As a regular home user, you can do everything you need to do from a regular user account that has administrative privileges.
Experienced users who need access to the built-in Administrator account can get to it through Safe Mode. We talk about that in Chapter 11. But if you aren't a professional, we suggest you stay away from that and use an administrative account, discussed in the next section.
Most of the time when you hear reference to an Administrator account in Windows 10, that reference is to a regular user account that has administrative privileges. This is an account that has virtually all the power and privilege of the built-in Administrator account. But it also has lots of security built in to help thwart security threats that might otherwise abuse that account's privileges and do harm to your computer.
Ideally, you should create one user account with administrative privileges on your computer. If you intend to implement parental controls, you need to password-protect that account to keep children from disabling or changing parental controls.
A standard user account is the kind of account everyone should use for day-to-day computer use. It has enough privilege to do day-to-day tasks such as run programs, work with documents, use e-mail, and browse the web. It doesn't have enough privilege to make changes to the system that would affect other people's user accounts. It doesn't have enough privilege to allow children to override parental controls. And most important, it doesn't have enough privilege to let malware such as viruses and worms make harmful changes to your system.
If you use a standard account all the time, and use a built-in administrative account only when absolutely necessary, you'll go a long way toward keeping your computer safe from Internet security threats.
The optional Guest account exists to allow people who don't regularly use your computer to use it temporarily. Basically, it lets them check their e-mail, browse the web, and maybe play some games. It definitely doesn't let them make changes to your user account or anyone else's. Its limited privileges also help protect your system from any malicious software they might pick up while online.
Creating and Managing User Accounts
The best way to handle user accounts in a home setting is for one person to play the role of administrator, even if that person isn't a professional. In a home environment, that person most likely is a parent who needs to define parental controls. To begin, log in to a user account that already has administrative privileges. If you have only one user account, or you're taken straight to the desktop at startup, that account probably has administrative privileges.
As with most configuration tasks, you can create and manage user accounts through the Computer Management application, which you can access by right-clicking the Start button. Or you can create local accounts from the Accounts applet we just used to create a Microsoft account.
If you're in a standard account on a computer that already has a password-protected administrative account, you must enter the password for the Administrator account. Or, if the administrative account doesn't have a password, press Enter to leave the password box empty.
When you create a user account, you give it a name and choosing a type. After you've created a user account, you can change the name and type to better suit your needs. Use the Setting, Accounts page shown in Figure 4.8 or the Accounts screen shown in Figure 4.10 to make changes to accounts.
CAUTION
If you aren't careful when you delete a user account, you can delete all the files in that account. Read the section “Deleting User Accounts” later in this chapter before you delete an account. If you make a mistake, you can delete photos or other documents that may be difficult or impossible to recover.
You can change an Administrator account to a standard account, or vice versa, from the main Accounts page. For example, if you've been using an administrative account for your day-to-day computing since buying your computer, you may want to change it to a standard account for the added security that a standard account provides. At least one user account must have administrative privileges, so you can make this change only if at least one other user account on the system has administrative privileges.
To change an account's type, click the account's icon or name on the Accounts page. Then click the Change an Account link at the bottom right of the accounts page as That page lets you change the account in a number of ways when you click Change, or simply remove the account.
You have the option to set up local accounts without password protection (Microsoft accounts require passwords). If you share