User Accounts, Permissions & Windows Hello
Windows 11 Fundamentals
Chapter 4 · User Accounts, Permissions & Windows Hello
Chapter 2 covered the local-vs-Microsoft account decision made at setup; Chapter 3 previewed NTFS's own fine-grained ACL permission model. This chapter goes one level deeper on both — what an account can actually do once signed in, how Windows enforces that boundary moment to moment, and the sign-in methods (PIN, fingerprint, face) that sit on top of whichever account type was chosen.
Administrator vs. Standard User
Every Windows 11 account is either an administrator or a standard user. An administrator account can install software, change system-wide settings, and modify other users' accounts; a standard user is deliberately restricted from all three. The built-in Administrator account itself ships disabled by default — the account created during setup is a separate administrator account, not that one.
Running day-to-day as a standard user, with a separate administrator account reserved for the occasions that genuinely need it, is the same least-privilege principle Database Security 3 teaches for database accounts — applied here to a desktop user account instead of a database one. A compromised standard-user session can do meaningfully less damage than a compromised administrator session, for exactly the same underlying reason a database service account with only the permissions it actually needs limits the blast radius of a SQL injection.
User Account Control (UAC) — Enforcing the Boundary in Real Time
UAC is the mechanism that actually enforces the administrator/standard split moment to moment. Even a signed-in administrator runs most processes with standard-user-level rights by default; the moment an action genuinely requires elevation (installing software, changing a protected setting), UAC interrupts with a consent prompt on the secure desktop — a separate, isolated desktop session that ordinary applications, including malware already running on the regular desktop, cannot programmatically interact with or dismiss.
UAC's own notification level is adjustable (Control Panel's "Change User Account Control settings," reached from Chapter 1's own legacy-interface material) — from always notifying, down to never notifying at all.
NTFS Permissions in Practice
Chapter 3 introduced NTFS's ACL model in outline; this is what using it actually looks like. Right-clicking any file or folder and opening its Security tab shows the exact list of users and groups with explicit permissions on that object, each with their own combination of read, write, modify, and full control. Permissions set on a parent folder are, by default, inherited by everything inside it — a folder-level change silently cascades to every file underneath unless inheritance is deliberately broken for a specific subfolder.
| Permission | What it actually allows |
|---|---|
| Read | View the file's contents and its own listed attributes/permissions |
| Write | Modify contents, create new files inside a folder |
| Modify | Read + Write, plus delete |
| Full Control | Modify, plus change permissions on the object itself and take ownership |
Windows Hello — PIN, Fingerprint & Face
Windows Hello covers three sign-in methods: a PIN, a fingerprint (via a supported reader), and facial recognition (via an infrared camera, not a standard webcam — a real hardware distinction, since infrared depth data is what prevents a simple photograph from fooling it). All three rely on the same TPM hardware Chapter 2 already covered as a Windows 11 installation requirement.
A genuinely counter-intuitive but well-documented fact: a Windows Hello PIN is not simply "a shorter, weaker password." It's bound to the specific device via a TPM-backed asymmetric key pair — the PIN itself never leaves the machine and is never transmitted anywhere, unlike a password, which is what actually gets sent to (and potentially phished or reused across) a remote service. A leaked PIN from one device is useless on any other device, since there's no matching private key anywhere else to pair it with.
Hands-On Exercises
Explain, using this chapter's own comparison, why running day-to-day as a standard user with a separate administrator account for occasional use mirrors the same principle Database Security 3 teaches for database accounts.
📄 View solutionExplain why a UAC consent prompt appears on a separate secure desktop rather than as an ordinary on-screen dialog, and what specific attack this design choice prevents.
📄 View solutionA colleague argues that a 4-digit Windows Hello PIN is objectively weaker than their own long, complex account password, and should be disabled. Using this chapter's own explanation, explain why that reasoning misses a key structural difference between the two.
📄 View solutionChapter 4 Quick Reference
- Administrator vs. standard user — the built-in Administrator account is disabled by default; the setup-created admin account is a separate one
- Least privilege for desktop accounts mirrors Database Security 3's own principle for database accounts
- UAC — elevation prompts run on an isolated secure desktop malware cannot programmatically click through
- NTFS Security tab — Read/Write/Modify/Full Control, inherited from parent folders by default
- Windows Hello PIN — TPM-bound and device-specific, not a "shorter password," and not transmittable like one
- Turning UAC to "Never notify" removes real protection, not just prompt fatigue
- Next chapter: The Settings App, In Depth