standard user vs. admin
expressionIT supportsecurity
Daily work in an unprivileged account, elevation only when needed: the desktop version of least privilege, and malware's least favorite policy.
Most commodity malware simply fails without local admin.
Running a desktop without administrative rights is the single most effective endpoint control available, and it is unpopular for reasons that are worth engaging with rather than dismissing. A substantial share of malware that requires elevation simply fails on a standard user account, and a substantial share of the remainder is limited to that user's own data.
The objection is real: some software genuinely needs elevation, some legacy applications write to locations that require it, and users doing technical work install things constantly. A policy that makes people raise a ticket for every installation converts a security control into a productivity tax, and the predictable result is blanket exceptions that quietly restore the original state.
What works is targeted rather than absolute. Application allowlisting removes the need to install arbitrary software, just-in-time elevation grants rights for a task and takes them back, and separate accounts let an administrator do administrative work without browsing the web as one. The failure mode to avoid is the middle position: a policy strict enough to be resented, with enough exceptions that it protects nothing, which is where organizations land when the control is implemented without addressing the workflow it broke.