who's an admin on your windows pc? check in 1 minute

who's actually an admin on your windows pc right now

quick gut check: do you know every account that has full admin rights on your own computer? most people don't. maybe you set up a second account for a kid, or a tech guy "helped" you years ago and left himself a login, or windows created some weird account during a reinstall that you never noticed. admin rights are the keys to the whole house. if an account has them and shouldn't, that's free real estate for malware or anyone who gets physical access to your machine.

good news: checking this takes about a minute and fixing it takes maybe five. let's go through it.

step 1: list every admin on the box

open command prompt or powershell (doesn't need to be admin mode just to view) and run:

net localgroup administrators

this dumps every account and group that's a member of the local administrators group. you'll see your main account, probably something called "administrator" (built in, usually disabled by default), and if you're lucky, nothing else weird. if you're unlucky, you'll see an account name you don't recognize, a kid's login that somehow has admin, or a leftover support account from a repair shop.

write down every name you don't immediately recognize. that's your to-do list for the next steps.

step 2: figure out which accounts are even still used

now check all the local accounts on the machine, not just the admins, so you can see the full picture:

Get-LocalUser

this powershell command lists every local user account along with whether it's enabled and when it was last used (on newer builds you'll see a "LastLogon" type field, depending on your windows version). cross reference this list with the admin list from step 1. an account that's enabled, has admin rights, and hasn't logged in for two years is exactly the kind of thing attackers love to find. it's quiet, it's privileged, and nobody's watching it.

disable anything stale. you don't have to delete accounts right away if you're nervous about breaking something, just disable them first:

Disable-LocalUser -Name "old_account_name"

give it a few weeks. if nothing breaks, you can remove it entirely later.

step 3: pull admin rights off accounts that don't need them

here's the actual fix. once you know which accounts shouldn't be admins, you remove them from the group with:

Remove-LocalGroupMember -Group "Administrators" -Member "account_name"

this doesn't delete the account or lock anyone out of the computer. it just drops that account from admin into a regular standard user. they can still log in, still use their apps, still browse the internet. they just can't install random software, change system settings, or do the things that malware needs admin rights to pull off silently.

this is the single biggest lever here. most malware that runs with a standard user account hits a wall pretty fast. the same malware running under an admin account can install itself deep into the system, disable security tools, and spread without asking permission for anything.

step 4: make your daily driver account a standard user

this is the part people skip and it's the most important one. if you personally log in and browse the web, check email, and open random attachments all day using an admin account, you are one bad click away from giving an attacker full system control. the fix is simple: use a standard account for everyday stuff, and keep a separate admin account specifically for installing software and making system changes.

windows will prompt for admin credentials (uac) whenever something actually needs elevated rights. that little popup is doing its job, it's forcing a decision point instead of letting things happen silently in the background.

to switch, create a new standard account if you don't have one, move your files and settings over, then demote your old daily account using the remove-localgroupmember command from step 3.

the takeaway

less access means less damage when something goes wrong, and something eventually goes wrong on every machine. checking your admin list isn't paranoid, it's basic hygiene, same as changing your oil or checking your smoke detector batteries. run net localgroup administrators right now, see who's actually in there, trim what doesn't belong, and switch your own daily account to standard if it isn't already. save this post, and if you're the designated it person for your family, send it to yourself as a reminder for every machine you've ever touched.