In IT, the path of least resistance is often the path of greatest risk. Admin rights feel like a shortcut — until they become the reason everything breaks.
There’s a pattern we see repeatedly in small and mid-sized businesses across Costa Rica. Someone — usually the first tech-savvy person hired — set up the office computers years ago. They gave themselves administrator access. Then, because it was easier, they gave everyone else admin access too. No more help desk tickets for software installs. No more asking IT. Everyone could do what they wanted.
It worked great. Until it didn’t.
The Incident
A sales manager at a distribution company received an email with an invoice attachment. She opened it. The file triggered a macro that downloaded ransomware. Because she had local admin rights, the malware could install itself silently, encrypt the local hard drive, and begin scanning the network for shared folders to encrypt as well.
Three hours later, 40% of the company’s shared drive was encrypted. The ransom demand was $18,000 USD. The actual recovery cost — backup restoration, forensic investigation, two days of lost productivity — was closer to $35,000.
The root cause in the security report? Admin rights on a standard user account.
Why Admin Rights Are a Security Problem
When a user with administrator privileges opens a malicious file, that file inherits their permissions. It can install software, modify system files, disable security tools, and spread across the network — because the user “authorized” it by running it. A standard user account, by contrast, can’t install software or modify system configuration. Malware running as a standard user is severely limited in what damage it can do.
The principle here is called least privilege: every user and every process should have only the permissions they actually need to do their job — nothing more.
What the Right Setup Looks Like
- Standard accounts for all daily work, including IT staff when doing routine tasks.
- Separate admin credentials used only when administrative tasks are actually required.
- Group Policy or MDM enforcement to prevent privilege escalation.
- Application whitelisting where possible, so only approved software can run.
- Regular privilege audits: who has admin rights, and do they still need them?
The Uncomfortable Truth
Removing admin rights from users generates complaints. People don’t like being told they can’t install software or change their screensaver without calling IT. But the short-term friction of proper access controls is orders of magnitude smaller than the cost of a ransomware incident, a data breach, or a compliance audit that reveals your entire organization has been running with excessive privileges for years.
If your users have local admin rights on their computers, that’s not a setting — it’s a risk that needs to be addressed. Talk to us before it becomes a story you’d rather not tell.