Reduce the risk by using a standard account for everyday work, approving elevation only when you understand why it is needed, keeping Windows updated, and preventing untrusted or vulnerable code from running where practical. For organizations, application control can add another layer, but it must be maintained and does not replace antivirus. These steps reduce exposure and limit damage; they cannot make a PC invulnerable.
What makes privileged software risky?
A program running with administrative rights can make changes that an ordinary user-level program cannot. The same concern applies to kernel drivers, which operate with high privileges. If vulnerable or malicious code gains those capabilities, the potential impact is greater than if it were confined to a standard-user context.
As an Amazon Associate I earn from qualifying purchases.
The protections below address different points in that chain: user account controls limit elevation, application control restricts what code can run, updates fix known vulnerabilities, and driver blocking can stop selected vulnerable drivers from loading.
Recommended Free Tools
Use a standard account for everyday work
When an application is launched normally from Windows Explorer, it ordinarily runs with the permissions of the current user. Using a standard account for routine activity therefore limits what applications can do without additional authorization. Reserve administrator credentials for tasks that genuinely require them.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
User Account Control (UAC) prompts when an action needs administrative rights. Leave UAC enabled: Microsoft says it is enabled by default and helps limit malicious code from executing with administrator privileges. Treat a prompt as a decision, not a routine click. Check which program is requesting elevation and whether the task you started actually requires it before approving.
Use just-in-time elevation where available
Windows 11 Administrator protection is designed to provide elevation only when needed. It requires user authorization and Windows Hello integrated authentication; the temporary elevation token is discarded when the process ends. Microsoft documents support for Windows 11 Home, Pro, Enterprise, and Education, but not Windows 365 Cloud PCs or Azure Virtual Desktop session hosts. The feature is off by default, and availability can depend on the current Windows version and configuration.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For details and current setup guidance, see Microsoft’s Administrator protection documentation. If the option is not available on a particular PC, continue using UAC carefully and avoid working as an administrator by default.
Restrict which code can run when your environment supports it
Application control decides which software is allowed to run; it is different from UAC, which governs requests for elevation. Depending on the policy, Windows application control can cover apps, scripts, MSI installers, command-line batch files, and interactive PowerShell sessions.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For an individual PC
Smart App Control is intended for consumers and simpler application portfolios. Its availability and behavior depend on Windows version and device state, so check Microsoft’s Smart App Control guidance for current details.
For organizations
App Control for Business is designed for managed policy scenarios. It can prevent unapproved code from running, but it is most appropriate when an organization can define and maintain a trusted application policy. Application control complements active antivirus; it is not a substitute for it. Microsoft’s App Control for Business documentation explains the policy approach.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Plan application control as an ongoing operation
Application control can block legitimate software when applications change or a policy does not account for a needed component. Before broad enforcement, establish how policies will be tested, monitored, updated, and supported.
- Roll out policies in stages and collect App Control events so unexpected blocks are visible.
- Keep policy files in a centrally managed, version-controlled repository and revisit them when software or trust boundaries change.
- Prepare a helpdesk process and a defined way to request and approve exceptions.
- Protect the policy itself. In some configurations, administrators can modify or remove policies; Microsoft’s mitigations include signed policies and limiting who can elevate.
Microsoft’s application compatibility guidance and policy management guidance cover rollout and maintenance considerations.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Install Windows security updates
Keep Windows current so cumulative quality updates can deliver security fixes. Microsoft says these fixes help protect devices against exploitation of unpatched vulnerabilities. Updates do not eliminate every risk, but delaying them leaves known issues unaddressed. See Microsoft’s quality updates documentation for how those updates are delivered.
Be cautious with kernel drivers
Drivers run with high privileges, so a vulnerable driver can create risks beyond the application that uses it. Avoid routinely installing drivers from unfamiliar download sites. Windows includes a vulnerable-driver block policy that is enabled by default and can be configured through Windows Security. Microsoft’s recommended driver block rules explain the policy and its scope.
How the layers differ
| Protection | What it controls | Best fit or limitation |
|---|---|---|
| Standard account and UAC | Whether a program receives administrative rights | Useful on individual PCs and organizations; prompts require informed approval. |
| Administrator protection | Just-in-time elevation, with a temporary token discarded after the process ends | Windows 11 feature with version and device exclusions; off by default. |
| Smart App Control | Which apps and other code may run | Aimed at consumers and simpler application portfolios. |
| App Control for Business | Which code is allowed under managed policy | For organizations able to maintain policy, monitoring, support, and exceptions. |
| Windows security updates | Known vulnerabilities addressed by security fixes | Keep Windows current; updates do not replace other protections. |
| Vulnerable-driver block policy | Loading of selected vulnerable drivers | Enabled by default in Windows; policy scope and configuration matter. |
Microsoft’s privileged-access guidance emphasizes that there is no single solution: protections should be combined to address different attacker entry points.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
