Recently I stumbled across a posting named “Why I run as an admin”. As you can deduct from the title, it is a small rant from a guy about why he runs as an admin. There are lot of rants like this flying aroun in the blogosphere (and not only there), so what makes this one interesting?

It's the attitude. Or more precisely - the wrong attitude of the post. The message that the author conveys is “Security is hard; running as regular user is hard; I won't do it”. And that is coming from somebody that is in our industry. So with this attitude, why do we even expect to get the regular users run as regular users on their computers?!

Let's take a look at the complaints:

1. “Can’t see calendar as non-admin” – This is the only legitimate complaint that really is a problem. I've been given this argument countless times, when I ask somebody “Why don't you run as non-admin?“. I would argue that this is the single most stupid reason to run as an admin. Yes, this is known limitation of the os and it should be fixed. But please, get over it and be secure! There are miriad of other ways you can see the calendar. Besides, if this is one of your critical tasks – you most probably are one of the people that have Outloook (or any other calendar application) always open anyway.
   (I don't want to discuss the scenario, where one doesn't use PIM and needs to see the calendar every half an hour. If one can't even remember the current date, they definitely should NOT be running as an admin)
2. “Can’t install anything” – How often does one need to install new programs? You can always switch to admin account when you need to install a new program. But wanting to run as admin so that you can install anything at anytime? This is like wanting to run as admin because you might need to change the permissions for one of the users at any time.
   As for Windows Update not being able to run as limited user - this is very arguable point. In the big enterprises, installing OS updates is often a matter of IT department policy and is not at the discretion of the computer users. Even at home, not all the regular users need to be able to do it. (I am sure I don't want my wife to be able to do it :-)).
3. “XP SP2, the firewall” – I have not run XP SP2, but I can imagine that the problem here is with the firewall blocking outgoing connections in various programs. This is not a reason to run as admin. The proper procedure is – log on as admin, configure the applications you know and want to enable to connect to outside world and be done with it. If you install new application, you do it as an admin (see the previous point) and at the same time you configure it in the firewall. Regular users shouldn’t be able to drill holes in the firewall anytime they open the new “I love you” email.
4. “On my home computer, I once changed my account and my wife’s account to be a limited user without telling my wife. Let me tell you, that’s a mistake that I will only make once.” – Even though this wasn't a numbered argument, it sounded like a major issue for the author. Definitely, the WAF (wife acceptance factor :-)) can be a serious roadblock for anything. However, the only mistake that this guy did was that he did it without telling his wife. But that has nothing to do with the whole “running as admin” problem, it’s just a question of “marriage smarts”. :-)
   (As an example - at home my wife is running as a limited user for more than a year. I am also running as limited user for everyday tasks. I use the admin account for admin tasks. Everything works and my wife didn’t hit any problems so far.)

Granted, there are problems with a lot of programs when installed as an admin, but run as regular user. There are also other problems with running as regular user. But running always as admin is not the answer. And telling people to do so is a bad thing. It's hard enough to try to educate the users to run as regular users, when lot of software companies support/FAQ says something in the line of: “So, Mr. Joe User, you are saying that our latest and greatest game Unreal Quake 2011 doesn’t run? Check our FAQ, that’s known problem, you have to be an admin on your machine.”.

The message “I will not attempt to be secure, because it’s too hard” coming from an IT professional is just plain wrong.