Article Summary: Employees should use standard accounts for email, web browsing and everyday work. Administrator access should be limited to approved IT tasks and protected with a separate account.
Administrator access often starts with one request. An employee needs to install a printer, update a specialist program or change a setting on their computer.
Giving them administrator access gets the job done. The problem is that the access usually stays after the request has been completed.
From then on, the employee can approve other software installations and make changes that would normally require help from IT. If they install the wrong program or someone takes control of their account, those permissions can also be used to change the computer.
For everyday work, employees should use standard accounts. Administrator access should be kept for tasks that require it.
What Administrator Access Allows Someone to Do
An administrator has more control over a computer than a standard user.
On Windows, members of the local Administrators group have full control over the resources on that computer. According to Microsoft’s guidance on local accounts, Microsoft recommends limiting the number of users in that group.
Depending on the computer and how it is managed, an administrator may be able to:
- Install and remove software
- Add drivers for printers and other equipment
- Create, change or remove user accounts
- Change system settings
- Change permissions on files and folders
- Install services that continue running in the background
- Make changes to some security settings
Mac computers also have standard and administrator accounts. Apple says administrators can install and remove software, manage other users and change settings. Apple recommends limiting the number of administrative users and using a standard account when administrator rights are not required.
Local administrator access applies to the computer itself. It is different from Microsoft 365, Google Workspace, network or server administrator access. Those accounts may control email, cloud files, user accounts or several systems at once.
An employee may have local administrator access to a laptop without being a Microsoft 365 administrator. Both types of access should be reviewed separately.
Why Permanent Administrator Access Increases Your Risk
Software launched by an employee normally starts with the permissions available to that employee.
If the software asks for administrator approval and the employee approves it, the program may be able to install system components, change settings or affect information belonging to other users.
That matters when someone downloads a fake installer, opens a harmful attachment or installs software from an untrusted website. The employee may think they are approving a legitimate update while giving the program permission to change the computer.
Windows uses User Account Control to ask for approval before many administrative changes. An employee signed in with an administrator account can approve the request themselves. A standard user is normally asked for credentials belonging to an administrator.
Microsoft describes the standard account as the recommended and more secure way to use Windows.
Standard accounts also reduce the number of people who can change security settings without review. Employees cannot approve every installation themselves so IT has a chance to check the program, where it came from and what permissions it needs.
CISA advises businesses to control local administrator access and restrict who can install software. The Australian Cyber Security Centre includes restricting administrative privileges in its Essential Eight security measures and recommends creating separate accounts for administrative work.
Standard Accounts are Suitable for Everyday Work
A standard account can still be used for normal business tasks including:
- Reading and sending email
- Using a web browser
- Working in Microsoft 365 or Google Workspace
- Accessing approved business applications
- Joining online meetings
- Printing with an installed printer
- Opening and saving files
- Changing personal settings that do not affect other users
Some applications can be installed for one user without administrator access. Others need administrator approval because they add drivers, services or files in protected parts of the computer.
An employee should not receive permanent administrator access because one program needs an update. IT can approve the installation, deploy the update remotely or use a separate administrator account for that task.
Older business applications sometimes expect the user to have administrator rights. Test those applications before changing account permissions. In many cases, IT can update the application, adjust its configuration or grant access to the specific folders it needs.
How to Manage Software Installations Without Permanent Administrator Access
Staff can still get software installed and updated without keeping administrator rights.
Let IT install Approved Software
Your IT team or provider can install the program remotely. This also gives them a chance to confirm that the installer came from the software company and that the requested version is supported.
Use Managed Software Deployment
Businesses with managed computers can send approved applications and updates to employees without asking each person to run an installer. The available method will depend on the operating system and device management service.
Approve Individual Requests
An employee can contact IT when an installation requires administrator approval. IT can review the request and enter the required credentials without giving the password to the employee.
Provide Time-Limited Administrator Access
Some roles need to install or test software as part of their work. Give those employees a separate administrator account that is enabled only for the approved task and then disable it afterward.
Create a Separate Administrator Account
Employees who regularly perform approved technical work can have a separate administrator account. They should continue using their standard account for email, browsing and normal work.
The administrator account should only be used when a task requires the extra permissions.
Who Should Have Administrator Access?
Administrator access should be limited to people with work that requires it.
That may include:
- Your internal IT staff
- Your IT provider
- An approved technical employee
- A software specialist responsible for a particular system
Business owners should use standard accounts for their normal work too. Ownership of the company does not require permanent administrator access to every computer.
Your IT provider should keep a managed administrator account so they can support each device. The password should be protected and should not be shared with employees.
Using the same local administrator password on every computer creates another problem. If that password is stolen from one device, it may work on the others. Each computer should have a unique administrator password or use a management service that controls those passwords.
How to Remove Administrator Access Safely
Do not remove every administrator account at once. Someone still needs a working way to manage and repair each computer.
1. Check which employees have administrator access.
Review the local Administrators group on every Windows computer and the administrator users on every Mac. Include old accounts, shared accounts, vendor accounts and accounts created during the original setup.
2. Confirm why each person has it.
Ask what tasks require administrator access. A clear business need should exist for every account that keeps the permission.
Needing to update one application occasionally does not require permanent access.
3. Make sure IT has a working administrator account.
Confirm that your IT team or provider can sign in with a protected administrator account before removing permissions from employees.
Test the account on each device. This prevents the business from being locked out of its own computers.
4. Test important software.
Check the programs each employee needs for their job. Confirm that they open, update and work correctly when the employee uses a standard account.
Any application that fails should be reviewed before administrator access is removed permanently.
5. Change the employee’s account to a standard account.
Once the computer has been checked, remove the employee from the local administrator group or change the account type.
The employee should then sign out and sign back in so the new permissions apply correctly.
6. Tell staff how to request an installation.
Give employees one place to contact when they need software installed or a setting changed. Explain what information to include such as the program name, the reason it is needed and the official download page.
7. Review access when roles change.
Check administrator access when an employee changes jobs, receives new responsibilities or leaves the business. Include it in your regular access reviews as well.
Frequently Asked Questions
Can a standard user install software?
It depends on the software. Programs that only install inside the employee’s user profile may not need administrator approval. Software that changes protected system files, installs drivers or adds background services usually requires administrator credentials.
Will removing administrator access stop employees from working?
Normal business applications should continue working. Test specialist and older applications before making the change across every computer.
Does removing administrator access stop malware?
It reduces what many harmful programs can change but it does not prevent every attack. You still need supported software, security updates, endpoint protection, email security, MFA and tested backups.
Should the business owner keep administrator access?
Use a standard account for everyday work. If you need administrator access for an approved task, use a separate account and keep its password protected.
Is local administrator access the same as Microsoft 365 administrator access?
No. Local administrator access controls one computer. Microsoft 365 administrator roles can control cloud users, email, files, security settings and other parts of the company’s Microsoft environment.
Both should be limited and reviewed.
Sources and Further Reading
- Microsoft Learn: Local accounts
- Microsoft Learn: How User Account Control works
- Apple Support: Set up your Mac to be secure
- CISA: StopRansomware Guide
- Australian Cyber Security Centre: Restricting administrative privileges
If you are not sure who has administrator access or whether your employees need it, ask your IT provider to review the accounts on your business computers.
If you don’t have an IT provider, feel free to reach out to us and we will help you sort it out.
Article summary: Shared mailboxes can become a security risk when they lack a clear owner, strong authentication, and regular access reviews. Blocking direct sign-in and giving authorized users delegated access through their own accounts reduces the risk of password spraying and account takeover. Regular permission reviews keep shared mailboxes useful without leaving unnecessary access open.Read more
Article summary: Attackers who compromise a business email account can create malicious email forwarding rules that secretly hide, delete or redirect important messages. These rules can expose invoices, wire instructions and password reset emails even after the original account compromise is discovered. Regular mailbox rule reviews and tighter forwarding controls can uncover this hidden access before it leads to data theft or financial fraud.Read more
Article summary: Guest Wi-Fi and smart devices can create a security risk when they share the same network as computers handling sensitive business data. Guest Wi-Fi network security separates visitors and connected devices from systems that access payroll, client records and financial information. This limits how far a compromised device can reach and closes an often overlooked gap in small business security.Read more
Article summary: Canceling a cloud service or marketing tool can leave behind a dangling DNS record that still points to the old provider. Attackers can exploit these records to host scam pages, malware or other content under a legitimate business domain. Subdomain takeover prevention removes these forgotten connections before they can become a security risk.Read more
Article Summary: Most small business websites run on WordPress and the biggest risk is usually old plugins that nobody has updated. Attackers scan the web for these known weak spots and use the sites they find to spread malware, post spam or steal what visitors type into forms. Keeping the site and its plugins updated and knowing who is responsible for that prevents most of it.
Your website is one of those things you set up once and then stop thinking about. It sits there doing its job so there is no reason to touch it. That is exactly why a neglected website is one of the common ways a small business gets hacked.
Most small business sites run on WordPress which powers more than 40% of all websites according to W3Techs. WordPress itself is solid. The risk is usually the plugins and themes added to it (which often don't get updated for years).
How a Neglected Website Gets Hacked
Attackers don't usually pick your business by name. They run automated tools that scan huge numbers of websites looking for known weak spots like a plugin with a security hole that has not been fixed. When the tool finds one, it breaks in. It is all automatic and it isn't aimed at you personally.
That is why old plugins are the problem. When a plugin maker finds a security flaw, they release an update to fix it. Until you install that update, the hole stays open and the automated scanners know exactly what to look for. Security researchers who track WordPress flaws find that the large majority are in plugins and themes rather than in WordPress itself.
What a Hacked Website is Used For
A hacked website rarely announces itself. Instead of shutting your site down, attackers usually keep it running and use it for their own purposes:
- Serving malware. Your site gets changed so that visitors are infected or pushed to a page that tries to install something.
- Spam and scam pages. Attackers add hidden pages selling fake goods or pushing scams to ride on your site's good standing with search engines.
- Stealing form data. If your site has a contact or checkout form, a hacked site can copy what people type into it (including personal or payment details).
- Visitors who click your link get sent somewhere else (often a scam or malware site).
The damage lands on you even though the attacker was after your visitors. Search engines flag hacked sites with warnings and drop them down the rankings and browsers may block them so customers see a red "this site may be dangerous" screen instead of your homepage.
Is Your Website at Risk?
It depends on how your site is built.
If you use a hosted website builder like Wix, Squarespace or Shopify, most of the security and updates are handled for you behind the scenes so your risk is lower.
If you have a self-hosted WordPress site (usually set up by a web designer or agency on your own hosting) then keeping WordPress, the plugins and the themes updated is someone's job. The question is whose. On a lot of small-business sites, the honest answer is that nobody has touched it since it launched.
You can usually tell your site is at risk if you don't know who maintains it, it hasn't been updated in a year or more or it is running plugins from a developer who has since disappeared.
How to Keep Your Website Safe
Keep everything updated. WordPress, plugins and themes all need updating when new versions come out. Many sites can be set to update automatically.
- Remove plugins you don't use. Every extra plugin is another thing that can go wrong. If you are not using it, delete it.
- Stick to well-known plugins. Use ones that are popular, well-reviewed and updated recently. Avoid anything that hasn't been touched in years.
- Watch for abandoned plugins. Sometimes a plugin stops being updated or gets removed from the plugin store because of a security problem. When that happens, it stops getting fixes so check now and then that the plugins on your site are still supported and replace any that aren't.
- Lock down the admin login. Use a strong and unique password for the website's admin account and turn on multi-factor authentication if your setup supports it.
- Add a security plugin or web firewall. A reputable one can block common attacks and warn you when something changes. Your web host or IT provider can recommend one.
- Keep backups. If the worst happens, a recent backup lets you restore the site instead of rebuilding it from scratch.
- Know who is responsible. Decide who looks after updates and security,whether that is your web designer, your IT provider or your hosting company and make sure it is clearly somebody's job.
What to Do if Your Site is Hacked
If your site does get hacked, moving quickly limits the damage:
- Get help straight away. Cleaning a hacked site properly is a job for your web host, IT provider or a website security service. Most hosts have dealt with this many times and can help.
- Take the site offline. Putting up a simple "down for maintenance" page stops visitors from being harmed while it is cleaned up.
- Change the passwords. From a device you know is clean, change the passwords for your hosting account and the website's admin login and turn on multi-factor authentication.
- Restore a clean backup. If you have a backup from before the hack, restoring it is often the fastest fix. If you don't, the site will need to be cleaned by hand.
- Update and tidy up before it goes back live. Update WordPress, the plugins and the themes and remove anything you don't recognize or no longer use so the same hole doesn't get used again.
- Tell anyone whose data was affected. If the site handled customer details or payments, check whether any of that was exposed and let those people know if it was.
Frequently Asked Questions
How do I know if my website has been hacked?
Common signs are a warning from Google or your browser such as a drop in search traffic, pages or pop-ups you didn't add or your web host getting in touch about a problem. If you are not sure, your IT provider or web host can check.
Do I need to update my website if it works fine?
Yes. A site can look completely normal to you while an out-of-date plugin leaves a door open for attackers. Updates close those holes which is why they matter even when nothing looks wrong.
I use Wix or Squarespace. Am I at risk?
Much less so. Hosted builders handle the updates and most of the security for you. You should still use a strong admin password and MFA but you are not responsible for patching plugins the way a self-hosted WordPress site is.
Who should maintain my website?
Someone should own it clearly: your web designer or agency, your IT provider or your hosting company depending on your setup. The important thing is that someone is actually doing the updates.
What is a security plugin or web firewall?
It is a tool that sits on your website, blocks common attacks, watches for changes and can alert you to problems. On WordPress, a reputable security plugin is a common and low-cost way to add that protection.
Article Summary: A passkey lets you sign in to an app or website using the same fingerprint, face or PIN you use to unlock your phone or laptop with no password to type. It is built on a security standard called FIDO that can't be phished because the passkey only works on the real site and there is no password to steal or reuse. Most major platforms and a growing list of business tools support passkeys and Microsoft 365 includes them at no extra cost. For most businesses, it is worth starting to roll them out beginning with the most sensitive accounts.
Passwords are the weak point in most businesses.
People reuse them across accounts, write them on sticky notes and type them into convincing fake login pages without realizing it.
Passkeys are the technology built to replace passwords and they fix the parts that cause the most trouble.
A passkey lets you sign in with the same fingerprint, face scan or PIN you already use to unlock your phone or laptop. There is no password to type so there is nothing for an attacker to steal, guess or trick out of you.
Let's look at what passkeys are, why they are so much harder to attack than passwords and whether your business should start using them.
What is a passkey?
A passkey replaces your password with your device's own security.
Instead of typing a password, you prove it is you the same way you unlock your phone: a fingerprint, a face scan or a PIN.
When you set up a passkey for a website, your device creates two matching keys.
The private key stays locked on your device and never leaves it.
The public key is stored by the website.
When you sign in, the site sends a challenge that only your private key can answer, your device answers it once you confirm with your fingerprint or PIN and you are in. The website never sees a password because there isn't one. This approach comes from a standard called FIDO which Apple, Google and Microsoft all build on.
Why Passkeys are Harder to Attack Than Passwords
A password is a secret you share with the website every time you log in and that is exactly what attackers go after.
A passkey has no shared secret. That one difference fixes the biggest problems with passwords.
- They can't be phished. A passkey only works on the real website it was created for. Land on a convincing fake and the passkey simply won't work so there is nothing to hand over. That matters because phishing is how most break-ins start.
- There is no password to steal in a breach. The website only keeps your public key which is useless on its own. If the company gets hacked, there is no password list to grab and try on your other accounts.
- Nothing to reuse or forget. Each passkey is unique to one site and made automatically so reused and weak passwords stop being a problem.
Older methods like text-message codes and app approval prompts can still be tricked out of people.
Where You Can Use Passkeys Already
Support has spread fast.
You can already sign in with passkeys to Microsoft, Google and Apple accounts plus a growing list of banks, password managers and business tools.
Apple, Google and Microsoft have built passkeys into their phones, laptops and browsers so the device in your pocket can already store and use them.
There are two types worth knowing.
A synced passkey is backed up to your Apple, Google or Microsoft account so it works across all your devices and you are covered if you lose one.
A device-bound passkey stays on a single device like a physical security key you plug in which is the most locked-down option and a common pick for sensitive accounts.
Should Your Business Use Them?
Most businesses should use them and you can start small. There is no need to switch everything overnight or drop passwords on day one.
If you use Microsoft 365, passkeys are already available through Microsoft Entra.
Staff can sign in with a passkey stored in the Microsoft Authenticator app, a security key or their own device. Google Workspace supports them too.
They are also faster. Microsoft says signing in with a synced passkey takes about 3 seconds against roughly 69 seconds for a password plus a traditional MFA code. Across a whole team, that adds up.
Here is how you can start using passkeys:
- Turn passkeys on for your most sensitive accounts first: administrators, finance and anyone who can move money or change systems.
- Let everyone else add a passkey as a faster and safer way to sign in alongside their normal login at first.
- Make sure each person has a backup (like a second device or a security key) so a lost phone doesn't lock anyone out.
Your IT provider can switch this on and run the rollout so nobody gets locked out along the way.
What to Watch Out For
Passkeys are not magic and a few things are worth planning for.
- Account recovery. If someone loses the only device with their passkey and has no backup, they can get locked out. A synced passkey or a second registered device fixes this but you need to set it up ahead of time.
- Not everything supports them yet. Support is growing fast but some older systems and smaller vendors still rely on passwords so you will run both side by side for a while.
- Shared devices and logins. Passkeys are tied to a person and their device so any shared computers or shared accounts need their own plan.
Frequently Asked Questions
What is a passkey in simple terms?
It is a way to log in using your fingerprint, face or PIN instead of a password. Your device proves it is you to the website and no password is ever typed or stored.
Are passkeys safer than passwords?
Yes. They can't be phished, there is no password for a hacker to steal in a data breach and there is nothing to reuse or forget. Security agencies like CISA recommend FIDO-based logins (which is what passkeys are) as the strongest widely available option.
What happens if I lose the device with my passkey?
If it was a synced passkey, it is backed up to your Apple, Google or Microsoft account and still available on your other devices. If it was device-bound and you have no backup, you would use a recovery method to get back in which is why setting up a second passkey or device in advance matters.
Does Microsoft 365 support passkeys?
Yes. Passkeys are available through Microsoft Entra at no extra cost including the free tier. Staff can use a passkey in the Microsoft Authenticator app, a security key or their device.
Do passkeys replace multi-factor authentication?
A passkey can count as multi-factor authentication on its own. Unlocking it needs both your device (something you have) and your fingerprint, face or PIN (something you are or know) so it covers two factors in one step and can replace the old password-plus-text-code routine.
Article Summary: AI note takers join your meetings, transcribe everything said and save the recording and summary to the vendor's servers. Who can see that recording depends on the tool. Some keep your data inside your own Microsoft or Google environment and never use it for training while others store it on their own servers and may use it to improve their AI. Some also auto-join meetings from your calendar without anyone pressing record. Before you let one into a client or staff meeting, it is worth knowing where the recording goes and getting everyone's consent.
AI note takers have become normal in a short time.
You start a Teams, Zoom or Google Meet call and a bot joins to record the conversation. Minutes later everyone gets a tidy summary with action items.
It saves real time which is why staff often adopt these tools on their own before anyone has asked where the recording ends up.
The problem is that every word of the meeting (including the parts you would never put in writing) gets captured, stored somewhere and read by whoever has access. Few business owners have stopped to ask who that includes or what happens to the recording afterward.
What an AI Note Taker Actually Does
An AI note taker is a tool that joins a meeting, records the audio and sometimes the video, turns the speech into a written transcript and produces a summary. Common ones include Microsoft 365 Copilot in Teams, Otter, Fireflies and Fathom.
Most connect to your calendar so they can join automatically and some will sit in on any meeting on your schedule unless you turn that setting off.
The recording and transcript do not disappear when the call ends.
They are saved (usually in the cloud) where they can be searched, shared and exported later.
Where they are saved and who can reach them depends on which tool you use.
Who can see the recording?
Start with the obvious group which is anyone the meeting organizer shares the summary with.
Many note takers email the transcript to every attendee by default and some send it to people who were invited but never joined. When the meeting covered a sensitive topic, that distribution list matters.
Then there is the tool's own access.
With a cloud note-taker, the recording sits on the vendor's servers which means the vendor's systems (and in some cases its staff) can reach it under the terms you agreed to.
If the tool auto-joined from someone's calendar, the recording may live on an account you do not control that belongs to whichever employee connected the bot.
A law firm publication on the legal risks of AI note takers warned that letting a note taker vendor access or use your transcripts for its own purposes can even risk waiving attorney-client privilege for businesses that handle legal matters.
Does the tool use your meetings to train its AI?
This is where tools differ the most and it is worth checking before you choose one.
Microsoft states that Copilot in Teams does not use your prompts, responses or meeting content to train its AI models and that the data stays inside your organization's Microsoft 365 environment.
Microsoft's privacy documentation says this directly and notes the content is processed within the Microsoft 365 service boundary rather than on the public version of the AI.
Third-party note takers vary widely.
Some store your recordings on their own servers and (depending on the terms you accept) may use that data to improve their models.
Others say they do not train on customer data at all. The only way to know is to read the specific tool's privacy terms because two tools that look almost identical can treat your data very differently.
The Consent Question
Recording a meeting is not always yours to decide alone and the rules change depending on where you and the other people are.
In around a dozen U.S. states and in most Australian states, everyone in a conversation needs to agree to being recorded.
Federal U.S. law, most other states and the UK allow recording when one participant consents.
On top of that, the UK and Europe treat recording people as handling their personal data so under GDPR you generally have to tell participants you are recording, explain why and have a proper reason for doing it.
That is why the safest way to go about this is to tell people the meeting is being recorded, explain why and give them a chance to object before the bot starts.
For client meetings, HR conversations and anything covered by confidentiality, that matters even more and in some cases you should check with a lawyer before recording at all.
How to Use AI Note Takers Safely
You don't need to ban these tools to use them responsibly.
Do this instead:
- Pick an approved tool and say so. Decide which note taker your business uses and ask staff not to connect others to company meetings. This keeps your recordings in one place you control.
- Turn off auto-join. Set the tool to join only when someone chooses to record rather than automatically for every meeting on a calendar.
- Announce recording and get consent. Make it normal to say a meeting is being recorded at the start and to skip recording when someone objects.
- Prefer tools that keep data in your environment. A note taker that stores recordings inside your own Microsoft or Google tenant and does not train on your data is easier to control than one that holds everything on its own servers.
- Control who gets the summary. Check the default sharing setting so transcripts are not emailed to everyone including people who missed the meeting.
- Keep bots out of sensitive meetings. For legal, HR, financial and confidential client conversations, the default should be no recording unless there is a clear reason and everyone agrees.
If you use Microsoft 365, an administrator can control whether Copilot and transcription are allowed in Teams meetings. That gives you one place to set the rule instead of relying on each person to get it right.
Frequently Asked Questions
Is it legal to record a meeting with an AI note taker?
It depends on where everyone in the meeting is. Around a dozen U.S. states and most Australian states require everyone to consent. The UK, federal U.S. law and most U.S. states allow it with one person's consent. In the UK and Europe, you also need to inform people and have a valid reason under data-protection law. The safe approach everywhere is to announce the recording and let people object before it starts.
Does Microsoft Copilot use my meeting data to train its AI?
No. Microsoft states that Copilot in Teams does not use your meeting content, prompts or responses to train its foundation AI models and that the data stays within your organization's Microsoft 365 environment.
Can an AI note taker join a meeting without me knowing?
Yes. Many tools connect to a user's calendar and can auto-join meetings (sometimes ones the user isn't even attending). You can turn auto-join off so the bot only records when someone chooses to start it.
Where are AI note taker recordings stored?
In the cloud. With Microsoft Copilot, the data stays inside your Microsoft 365 tenant. With many third-party tools, recordings sit on the vendor's own servers. Where they live and who can reach them depends on the tool so check its terms.
Should we let staff use Otter or Fireflies for work?
You can but with rules in place. Choose one approved tool, turn off auto-join, announce recording and get consent, check how the tool handles your data and keep it out of legal, HR and confidential client meetings.
Article summary: A small business incident response checklist gives your team clear steps to follow when something goes wrong. By deciding who to call, what to do first and who is responsible ahead of time, your business can respond faster and avoid making critical decisions in the middle of a crisis. Read more
Article summary: A USB drop attack relies on someone finding an unfamiliar drive and plugging it into a work computer. Research shows that happens more often than businesses might expect. Combining employee awareness with device controls that restrict unknown USB storage can prevent a moment of curiosity from becoming a larger security incident.Read more