No one works with administrator privileges for daily office tasks

To carry out daily tasks, users need certain access rights to the company's data, and potentially to some internet sites. However, they should not be able to modify the technical set-up of their work station (or have it modified), or to install dubious software.

Giving users administrator rights increases the risk of harm. Users are then able, even without knowing it, to perform sensitive operations such as increasing privileges, collecting information etc.

If certain people occasionally need an administrator account, create a second user account for them. They can then use their user account for standard work, and when they need to install or modify something, they connect to their admin account for the duration of the intervention.