What you need to know about Windows 10 accounts

WINDOWS 10: Dennis O'Reilly

Few things in Windows are simple, and that includes the various types of user accounts.

As with Win7, Windows 10 creates three types of accounts by default. But it also includes other account options such as Microsoft vs. local. Here's what you need to know.

Those three primary accounts include the default, admin-level user account and two hidden accounts: guest and administrator. (If you create new user accounts, Win10 automatically sets them to "standard," unless you change their status.)

With some restrictions, you can alter and delete the default accounts. But I'll wager that many Win10 users don't bother, which could leave them more vulnerable to malware than necessary.

If you need a good overview on creating Win10 accounts, EuroSCUG offers a downloadable PDF. As you probably know, Microsoft really wants you to set up Windows 10 with MS-account credentials. Yes, you can run Win10 with just a "local" account (more on that below), but you lose the automatic connection with services that rely on an online connection e.g., OneDrive and Outlook.

Regardless of the accounts you modify and create, you need at least two accounts on each Win10 PC: an administrator-level account and a backup account with sufficient privileges to repair the administrator account if it breaks. That backup account could be the hidden administrator account or another account you create.

Let's start with enabling the hidden admin account you already have.

Opening Windows 10's master account

To enable Win10's hidden Administrator account, open a command prompt: right-click Start and click Command Prompt (Admin). To see currently active user accounts, enter net user at the command prompt (see Figure 1). Next, enter net user administrator /active:yes and press enter. As you'd expect, you can disable the account by changing the command from "active:yes" to "active:no." (If you need to enable the guest account, type in net user guest /active:yes and press Enter.)

Net user command

Figure 1. The net user command lets you see local users and reveal/hide special accounts such as Administrator.

You can now access the Windows Administrator account no password needed. But it's obviously a good idea to password-protect it; you can do so right from the command prompt by entering net user administrator * and pressing Enter. You be prompted to enter a new password and then prompted to enter it again for confirmation. When you're done, close the command window.

To sign in to the now-active Administrator account, click Start and then your user name at the top of the Start menu. Click Administrator and enter your password. (Note: The first time you enter the account, it might take Win10 a bit of time to set it up.)

For more information on the uses of the Administrator account and how to enable it in Win7 and Win8, see the May 14, 2015, Top Story, "Activate Windows' hidden, master admin account."

Choose between standard or admin-user accounts

On numerous occasions, Windows Secrets has recommended setting up a standard-user account for most of your computing activities. As I'm sure you know, should a cyber criminal gain access to your system, it'll be more difficult for him to install malware on a standard account than on an admin-level account.

Unfortunately, many Windows users never set up and use a standard account. I've used one for years, and there are relatively few times when I've had to sign in to my admin-level account. Still, the choice is yours.

If you're new to Windows 10, you might, out of habit, set up new accounts and change existing accounts by opening Control Panel/User Accounts. But the Win10 way is to click Start/Settings/Accounts. Click Family & other users to add another account.("Accounts" is also where you manage your email and user-account settings, sign-in options, and other account settings.)

True to Win10's spit settings interfaces, you can change account types via either Start/Settings or Control Panel/User Accounts. But the latter has more account-management controls, depending on the type of account. There, you can, for example, manage your credentials, change account name, and set advanced user-profile properties.

Roughly speaking, Start/Settings is where you do general maintenance Control Panel is where you go for many advanced settings.

Netplwiz: The hidden User Accounts applet

What you can't do via either UI is set Windows to bypass the sign-in screen on boot. For these and other advanced actions, use the netplwiz Control Panel applet: open a command prompt as described above, enter netplwiz at the prompt, and press Enter.

In the User Accounts dialog box, under the Users tab, uncheck the box next to "Users must enter a user name and password to use this computer." Note, before the change is applied, Windows will request the default account and its password. On your next reboot, that account will open straight to the desktop. However, if you switch to another account, you'll be asked for its password.

There are other user settings you can change in the applet. For example, select a user and click Properties. In the dialog box that opens next, you can change an account's username, full name, and description; you can also select the account type: Standard, Administrator, and Other which has a drop-down menu with numerous options such as "Distributed COM Users," "Guests," and "Remote Management Users (see Figure 2)."

Account types

Figure 2. Along with Standard and Administrator accounts, Win10 offers various special accounts such as Guests.

Next choice: Microsoft or local account

Again, it's obvious that Microsoft wants you to sign in to Windows 10 with a Microsoft account. If you have an Outlook, Hotmail, Live, or MSN email address, you already have an MS account you can use for Win10 credentials. Using an MS account lets you sync desktop themes, browser settings, passwords, OneDrive files, and other Windows settings between machines and devices. You can't sync Windows Store apps or Start menu layouts.

So why would anyone choose a local account in this Internet-centric world of ours? Mostly for an added layer of privacy. As David Auerbach wrote in a Slate article, Microsoft grabs "loads" of information off your system, not to mention helping itself to some of your Internet bandwidth.

The company essentially treats the data on your system in much the same way it treats your data in the cloud. In fact, components of Windows 10 such as Cortana are mostly cloud-based. Since Win10's inception, Windows Secrets has recommended that you don't use Express settings when installing the OS, and that you review your Win10 privacy options after Win10 installation and updates. For more on that, see the Sept. 10, 2015, LangaList Plus column, "Working through Win10's many privacy settings."

Switching to a local account breaks many of Win10's live PC-cloud connections. You can either create a new local account or switch an MS account to a local version. To change an account, click Start/Accounts and select Your email and accounts. Next, click the "Sign in with a local account instead" link. You'll be prompted to enter the current account's password; you'll then enter a local account name and password (twice). Choose Next and then "Sign out and finish."

Note: You can change a local account to an MS account or create a new MS account.

A quick look at guest accounts and child accounts

If you've unhidden the Windows 10 guest account, you can switch to it by clicking your username in Start or by pressing Ctrl + Alt + Delete and choosing Switch User. Guests can't access your personal files, install software or hardware, change system settings, or add a password.

To limit guests to a single application, see the WonderHowTo article, "How to restrict guest users to on app in Windows 10;" it describes Win10's Assigned Access feature, also known as Kiosk Mode.

Another approach to creating a restricted-access account is to set up child accounts. These accounts let the user customize the desktop, browse the Web, and use applications. But the account's "parent" can receive activity reports on the child account, set browsing permissions, limit use time, and restrict access to games and other programs.

To create a child account, open Settings/Accounts and choose "Family & other users." Click "Add a family member" and then "Add a child" in the next window; step through the wizard.

Unfortunately, you have to provide an email address for the child account because it has to be a Microsoft account. As you can imagine, this has not pleased many parents, as have some of the other changes to family accounts introduced in Windows 10. Paul Thurrot outlines the changes in his article, "Inside Microsoft Family and Windows 10 Parental controls," and he notes the complaints from parents.

A plethora of account options. As you can see, Win10 makes managing user accounts only more flexible and complex. Along with different types of accounts, the new OS also gives you many ways to sign in to those accounts. Check out your options by clicking Start/Settings/Accounts/Sign-in options. Setting up a PIN can make switching between accounts a bit faster.