How to Remove Local Admin Rights in a Small Business Without Stopping Work

Start with a list. For every Windows and macOS device, record which accounts are in the local Administrators group on Windows or are ticked as administrators in Users & Groups on a Mac. In most small businesses the answer is that the first account set up on each machine, usually the owner or the employee, is an administrator by default, and nobody has revisited it since.

Next, ask what each person actually does that needs elevation. Typical answers are installing a printer driver, updating a specialist application, changing network settings, or installing a browser extension. Write these tasks down. The list tells you which tasks can be handled by your IT provider, which can be pre-installed, and which are habit rather than need. The NCSC Small Business Guide says staff should hold only the rights their job requires and use standard accounts for everyday work such as email and web browsing.

Create one named administrator account for support work, kept apart from anyone's day-to-day login. On Windows this is a local or directory account added to the Administrators group; on macOS it is a separate administrator user. It should have a strong unique password stored in your password manager, not shared in a chat message or a spreadsheet, and it should not be used for email or browsing. The NCSC guidance is that administrative accounts are for administrative tasks only.

Decide who may use it: the IT provider, or one named person in the business. Record the arrangement, including what happens if that person is away. If you manage devices through a tool such as Intune or Jamf, use it to hold the credentials or to run elevated tasks remotely instead of handing out the password. Do this step first, so that when staff lose their own rights there is already a working route to get things done.

Choose a small group that includes at least one person who installs things often, such as a designer or a finance user running older accounting software. Remove their local admin rights on a single day when your support contact is available. On Windows, take the account out of the Administrators group and sign out and in again. On macOS, untick the administrator setting for that user. The account stays; only the elevated rights go.

Over the following week, gather every blocked task: updates that failed, installers that asked for a password, peripherals that would not connect. Fix each one by pre-installing approved software, setting updates to run automatically, or adding the task to the exception process below. Test any specialist or older application explicitly, because some write to protected folders and fail without elevation. Once the pilot group is working normally, remove rights from the rest of the staff in two or three batches rather than all at once.

Staff will only accept the change if getting blocked is quick to resolve. Give them one place to ask, such as a shared mailbox, a chat channel or a phone number, and name who approves. Agree an internal response time you can realistically meet, because the NCSC and ICO guidance does not prescribe one and it depends on your support arrangements. For most requests the support person installs the approved software or performs the task using the support account, so the member of staff never receives ongoing rights.

For genuine edge cases, such as a developer or a person configuring test hardware, grant time-limited elevation and note the end date. Keep a simple record: who asked, what for, who approved, and when access ended. The ICO recommends restricting privileged rights, removing them promptly when no longer needed, and reviewing access regularly, particularly where staff handle personal information.

Local admin rights tend to creep back, usually through one urgent request that is never reversed. Add a review to your calendar, every quarter is reasonable for a small team, where you re-check the Administrators group on each Windows device and the administrator list on each Mac, plus cloud and third-party admin roles. Anyone who appears without a recorded reason loses the right until a reason is given.

Tie the same check to staff changes. When someone changes role or leaves, review their privileged access that day. If you are working towards Cyber Essentials, this routine supports its requirements to use separate accounts for administrative activity, remove special privileges when they are no longer required, and use multi-factor authentication for cloud services. Keep the exception log and review notes, since they show an assessor or an insurer that the control is operated, not just configured once.