Windows 11 user account management is one of those areas where a bit of upfront understanding prevents a lot of downstream frustration. Whether you’re setting up a family computer with separate accounts for each person, adding a work account to a personal machine, or trying to understand why you can’t install software on a company laptop — user accounts and account types explain the behaviour. For a broader walkthrough, our Complete Guide to Windows 11 is a good next read.
Account types — the most important concept
Every Windows 11 user account is either an Administrator or a Standard user. This distinction controls nearly everything about what that account can do:
- Administrator: can install software, change system settings, modify other accounts, install drivers, and make changes that affect all users on the PC. The first account created on a Windows 11 machine is an Administrator by default.
- Standard user: can use installed applications, change their own settings (wallpaper, password, personalisation), but can’t install new software or make system-wide changes without an Administrator’s credentials. Standard accounts prompt for an admin password when elevated actions are needed.
Best practice: use a Standard account for daily work and keep one Administrator account available for system changes. This limits the blast radius of malware or accidental changes — malware running in a Standard account context has fewer privileges to damage the system. On a family computer: children’s accounts should be Standard accounts specifically to prevent accidental or deliberate system modifications.
Creating a new user account
Settings → Accounts → Family & other users → “Add someone else to this PC.” Windows first prompts for a Microsoft account email address. If you want a local account (no Microsoft account, no cloud sync): click “I don’t have this person’s sign-in information” → “Add a user without a Microsoft account” → enter a username and password.
The resulting account is a Standard user by default. To make it an Administrator: Settings → Accounts → Family & other users → click the account → “Change account type” → Administrator.
For family members: Microsoft Family Safety provides parental controls for child accounts — screen time limits, content filtering, activity reporting, and spend controls for the Microsoft Store. Create a family group: accounts.microsoft.com/family → add your child’s account → configure controls from there. The family features require both accounts to have Microsoft accounts rather than local accounts.
Microsoft account vs local account — the core decision
Microsoft accounts sync settings, browsing data (via Edge), and enable cloud features across devices. They also tie the account to a Microsoft account password that can be changed from any device. Local accounts exist only on the specific machine, use a local password, and don’t sync anything. The trade-offs:
| Feature | Microsoft account | Local account |
| Settings sync across devices | Yes | No |
| OneDrive integration | Yes (automatic) | Manual sign-in only |
| BitLocker recovery key backup | Yes (to Microsoft) | Manual only |
| Password recovery | Via Microsoft account online | Security questions or reset disk |
| Microsoft Store apps | Full access | Limited (some apps require account) |
| Privacy (what Microsoft sees) | Account-linked activity | Minimal |
For most home users: a Microsoft account for the primary user provides the most seamless experience. For privacy-focused users or corporate environments: local accounts are appropriate. For children’s accounts with parental controls: Microsoft accounts are required for the Family Safety features to work.
Switching between Microsoft account and local account
Converting an existing Microsoft account to local: Settings → Accounts → Your info → “Sign in with a local account instead” → set a local username and password → sign out completes the transition. The Microsoft account is disconnected; all locally-stored data remains. OneDrive sync stops (unless you sign into OneDrive separately); settings no longer sync.
Converting local to Microsoft account: Settings → Accounts → Your info → “Sign in with a Microsoft account instead” → enter Microsoft account credentials → Windows connects the local account to the Microsoft account. Existing files and settings transfer; the account gains Microsoft account features going forward.
The hidden Administrator account
Windows 11 has a built-in “Administrator” account that’s disabled by default. This account has elevated privileges beyond a standard Administrator user account and has no UAC (User Account Control) prompts — every action runs with full admin rights without confirmation. It’s used for recovery scenarios when the primary administrator account is locked out or corrupted.
Enable it if needed for recovery: Admin Command Prompt → net user administrator /active:yes. Disable when done: net user administrator /active:no. Don’t use this as a daily account — the lack of UAC prompts means any malware that runs in this context has unrestricted system access. It’s a recovery tool, not a convenience.
Our guide on Windows 11 initial setup covers the account decisions during setup, and our guide on Windows Hello sign-in options covers the PIN and biometric authentication options for each account. For enterprise user account management through Azure AD / Entra ID, Microsoft’s Entra ID documentation covers the cloud-based identity management for managed Windows environments.
User Account Control (UAC)
User Account Control is the system that prompts for confirmation (or admin credentials) when a program attempts a system-level change. This is the “Do you want to allow this app to make changes to your device?” prompt. On Administrator accounts: UAC asks for confirmation. On Standard accounts: UAC asks for an Administrator’s password.
UAC levels: Control Panel → User Accounts → Change User Account Control settings → four levels from “Always notify” (most restrictive, prompts for every change) to “Never notify” (no prompts, not recommended). The default “Notify me only when apps try to make changes” is the right balance for most users — it prompts for software installations and system changes but not for manual settings adjustments you make yourself.
Sign-in options and password management
Settings → Accounts → Sign-in options shows all available sign-in methods for the current account: password, PIN, facial recognition, fingerprint, picture password, and security key. Each can be configured independently. A Windows Hello PIN, once set, can be used instead of the account password for everyday sign-in — it’s faster and device-bound (someone who knows your PIN still can’t sign in from another machine).
Password reset for Microsoft accounts: handled through account.microsoft.com → Security → Change password. If locked out of the machine: use a recovery code, an alternate email, or an authenticator app linked to the Microsoft account. If you’ve never set up recovery options on the Microsoft account: do this now rather than after a lockout.
For local account password resets: the login screen → click the account → “I forgot my PIN” or reset options. If these options are unavailable and the password is unknown: booting from Windows installation media → Repair your computer → Command Prompt → net user [username] [newpassword] resets the password, though this requires physical access to the machine.
Multiple accounts and fast user switching
Windows 11 supports multiple accounts signed in simultaneously through Fast User Switching. Win+L locks the current session and returns to the login screen where another account can sign in. The first account remains running in the background — its applications stay open and its session resumes when that user switches back.
This is useful on shared family computers: Parent signs in, uses the machine, switches to the child’s account when they want to use it. Both sessions remain active without either needing to close applications. The cost: both sessions’ RAM usage adds up — two active Windows sessions plus two sets of open applications requires more RAM than a single session.
Deleting a user account
Settings → Accounts → Family & other users → select the account → Remove → Windows asks whether to keep or delete the account’s files. “Keep files” saves the user’s Documents, Desktop, and a few other locations to a folder on the Desktop. “Delete files” permanently removes everything — photos, documents, application data, browser history — without recovery. If there’s any doubt: keep files and delete them manually after confirming nothing is needed.
User accounts are one of the most structural aspects of Windows 11 configuration because they determine what each person on the machine can do and what data they have access to. Getting account types right (Standard for daily use, Administrator available for changes, family safety for children) at the start of a machine’s life is considerably easier than adjusting them after bad habits have formed. Five minutes of account configuration at setup is worth more than it appears.
Work accounts and personal accounts on the same machine
Bringing a work account onto a personal Windows 11 machine (or vice versa) has specific implications worth understanding before doing it. Settings → Accounts → Access work or school → “Connect” → adding a work account here enrolls the device in the organisation’s device management (Intune/MDM). Once enrolled: IT has the ability to see the device in their management console, push policies, require device compliance (like BitLocker encryption), and in some configurations, remotely wipe the device.
This is the right setup for company-issued machines. For personal machines where you want to check work email: consider using the web browser for work applications (Outlook Web, Teams Web) rather than enrolling the device in MDM, which gives IT more access to a personal machine than most users intend when they add a work account. Adding just the work Microsoft account to Office apps directly is usually less invasive than the full MDM enrollment via Settings → Access work or school.
Guest mode and kiosk mode
For situations where you want someone to use the PC temporarily without having access to your account: Windows 11 doesn’t have a traditional “Guest account” enabled by default. Alternatives:
- Quick browser access: create a standard user account named “Guest” with no password for quick access. Less elegant but functional for occasional use.
- Kiosk mode (Assigned Access): Settings → Accounts → Family & other users → “Set up a kiosk” → configures a dedicated account that launches a specific app (usually Edge or a specific application) in fullscreen and restricts all other access. Appropriate for public-facing information terminals, demo machines, or reception desk computers.
Account sync and device trust
Microsoft accounts can be trusted to sync settings across multiple Windows 11 machines. When the same Microsoft account is signed into two machines: themes, display settings, browser favourites (Edge), and Wi-Fi passwords sync automatically. This “settings sync” is controlled at Settings → Accounts → Windows backup → “Remember my preferences” — toggle specific sync categories on or off.
Device trust also affects which applications accept your Microsoft account for SSO (single sign-on). A device that’s Azure AD joined (or Entra ID joined, the newer name) is trusted by the organisation and allows seamless sign-in to corporate resources without re-entering credentials. Personal Microsoft accounts work differently — they sync settings rather than establishing corporate trust relationships.
Account photo and display name
Settings → Accounts → Your info → “Open camera” or “Browse files” changes the account picture that appears on the login screen and in the Start menu. The display name for a Microsoft account is managed through account.microsoft.com → Personal info — changes there sync to Windows. For local accounts: the display name is set when the account is created and can be changed via: Computer Management → Local Users and Groups → Users → right-click the account → Properties → Full name field.
On shared PCs with multiple accounts: distinct account pictures make it visually obvious which account is which on the login screen — especially helpful for families where everyone’s account might otherwise look similar in the user list. This small setup detail saves the “which account is mine?” confusion that comes from default icons. You might also run into Windows 11 Keyboard Shortcuts.
User account management in Windows 11 rewards a thoughtful initial setup and requires minimal ongoing attention once configured correctly. The key decisions — account type (Administrator vs Standard), Microsoft account vs local, and family safety configuration for children — are all made during account creation and rarely need revisiting unless the household composition or the machine’s purpose changes. Understanding these decisions upfront, rather than accepting defaults and troubleshooting later, is the most practical approach to Windows 11 account management. Related: Block Ads with Pi-hole.
