220-1102 Question 487
Single answerRestrict user permissionsA small office uses Windows 10 Pro laptops joined to a workgroup. Several employees share a laptop in the reception area. The office manager reports that users have been installing unauthorized software and changing system settings, which has caused support issues. Management wants users to be able to sign in and use approved applications, but they should not be able to install programs or make system-wide configuration changes. Which action should the technician take FIRST to best meet this requirement?
- A
Change each employee's account to a standard user account
- B
Disable User Account Control (UAC) so prompts do not appear
- C
Encrypt the laptop's drive with BitLocker
- D
Share one local administrator account among all reception employees
Show answer and explanation
Correct answer: A
Explanation
The best answer is to change the employees' accounts to standard user accounts. In Windows, standard accounts are designed for everyday use and do not have the permissions needed for most software installations or system-wide administrative changes. This aligns with the security best practice of least privilege: users should have only the permissions necessary to perform their job functions. UAC is an additional protection layer, but it is not a substitute for properly assigning account types. BitLocker addresses storage encryption, not permission control. Shared administrator accounts are a poor practice because they expand privileges and eliminate individual accountability. Microsoft documentation and common endpoint security guidance consistently recommend using standard accounts for daily activities and reserving administrator accounts for administrative tasks only.
- A. Correct.
Correct. Standard user accounts are the appropriate first step when restricting user permissions on Windows. Standard users can run approved applications but are blocked from installing most software and making system-wide changes without administrator credentials. This follows the principle of least privilege, which is a core best practice for limiting accidental or unauthorized changes.
- B. Incorrect.
Incorrect. Disabling UAC reduces security rather than restricting permissions. UAC helps prevent unauthorized elevation of privileges by prompting for administrator approval when protected changes are attempted. Turning it off would make the system less secure and does not address the root issue of users having excessive privileges.
- C. Incorrect.
Incorrect. BitLocker protects data at rest by encrypting the drive, which is useful for lost or stolen devices, but it does not prevent signed-in users from installing software or changing settings if their account already has sufficient permissions. This option addresses a different security requirement.
- D. Incorrect.
Incorrect. Sharing a local administrator account would increase risk and reduce accountability. Users with administrator rights could install software and change system settings freely, which is the opposite of the stated goal. Shared admin credentials also make auditing difficult because actions cannot be tied to an individual user.