Protect a shared computer with separate user accounts

Decide who holds the administrator credentials

Keep one working administrator account under a trusted owner’s control. Everyone who borrows the PC needs their own standard account. The owner can also use a separate standard account for daily work, retaining the administrator account for maintenance. Before changing an existing account’s role, confirm that another administrator can actually sign in.

Microsoft’s User Account Control explanation describes why this matters: administrative tasks in a standard account normally require administrator credentials. That gives the owner a chance to inspect a requested change. It does not mean a standard account cannot run unwanted software or lose its own files. Leave User Account Control enabled, and decline unexpected requests rather than sharing the administrator password.

Separate accounts are a useful household boundary, but they do not protect secrets from the person who administers the machine. Administrators can access files and change permissions. If another user must never be able to access sensitive material, do not rely on account separation on a PC they control.

Give the next person a Windows login

Start from the administrator’s session. For a local account that belongs only to this PC, follow the route in Microsoft’s account-management guide:

1. Open Settings → Accounts → Other users, then choose Add account.
2. Choose I don’t have this person’s sign-in information, then Add a user without a Microsoft account. Complete the name, password and recovery prompts. Let the person keep their password private.
3. Expand the new user’s entry in Other users. Select Change account type, choose Standard User and select OK.

Alternatively, enter that person’s own Microsoft account email at the Add account prompt. This is a choice about how their Windows account signs in; either route still needs the standard account type. Never use the owner’s Microsoft account as a convenient substitute.

The expected result is a separate entry in Other users. This procedure adds a user to an already configured PC; it is not a workaround for initial Windows setup. If the account controls are unavailable or Windows requests administrator authorization you cannot provide, stop and involve the owner.

Treat the first sign-in as a clean start

Save your work and sign out. On the sign-in screen, select the new account and have its owner sign in. Allow Windows to finish preparing the desktop. A new desktop is expected: creating an account does not sort or transfer files from the previously shared account.

Open the browser from this new session. Check its displayed account and any sync prompt before accepting. Each person should use their own website credentials and, if wanted, their own browser sync identity. Signing everyone into the same cloud account can bring shared information back into otherwise separate Windows sessions.

Move only the files that belong to the new user. A deliberate copy of a school folder is easier to inspect than copying the entire old profile. Open a few copied documents from the destination account before removing any originals. Do not copy the old browser profile wholesale: its saved sessions and passwords defeat the purpose of starting separately.

Agree where genuinely communal files belong. A folder deliberately shared with everyone, the Windows Public folders, or a shared external drive is not a private filing cabinet. Keep personal documents in the intended person’s profile, and review sharing permissions before treating an existing common folder as private.

Rehearse the handoff with harmless data

Use this check before putting sensitive documents into the new arrangement. It is a suggested verification exercise, not a claim that this particular PC has been tested.

• In the first person’s account, create a harmless text file in Documents with a distinctive name. Note its location.
• Sign out, sign in as the second standard user and open Documents. It should show that user’s files, not the first person’s collection. Confirm that the signed-in browser identity also belongs to the second person.
• If you inspect the first person’s profile through File Explorer, do not supply administrator credentials or approve a prompt to gain access. If the second standard user can actually open the test file without elevation, investigate its location and sharing permissions before trusting the separation.
• Return to the first account, confirm the file is still there, then delete the disposable test file. Repeat with the roles reversed if both accounts already contained personal files.

A successful check reduces accidental crossover; it does not certify the whole computer’s security. If a supposedly private document is visible, first check whether it was saved to a common folder or shared cloud location. Do not experiment with broad permission changes on the entire Users folder.

When stepping away briefly, press Windows key + L. The session stays open behind the lock screen. When finished, save your work, open Start → your user picture or Accounts icon → Sign out. Windows closes your apps; unsaved work can be lost.

For a temporary handoff without closing apps, open Start, select your user picture or Accounts icon, open the three-dot menu and choose the other account. Microsoft’s current access guide illustrates that Windows 11 switching route. Switching leaves the previous session running, so arrange a later sign-out if the computer starts running short of resources. Never hand over an unlocked desktop as the shortcut.

Recover access before considering removal

For a forgotten local-account password, use the password sign-in option. After an unsuccessful attempt, select OK → Reset password and answer the security questions established during account creation. A previously created password reset disk is another documented option. Follow Microsoft’s local-password recovery instructions; a Windows Hello PIN and the account password are different credentials.

If recovery fails, preserve the existing account and involve the owner. Deleting it and making another with the same name is not password recovery. This guide does not walk through a forced administrator password reset or resetting Windows; those require assessing the files and recovery options first.

When someone stops using the PC, have them copy needed files elsewhere and open the copies to verify them. Then, from another administrator account, go to Settings → Accounts → Other users, expand their entry and select Remove beside Account and data. Read the confirmation carefully: removal deletes that account’s data from the device. It does not delete their online Microsoft account, and adding the user again will not restore deleted local files. Keep the verified backup until they have checked their new setup.