Can employees still install software themselves?

Not without someone in between. Standard software is rolled out automatically; for anything new the employee submits a request through the ticket portal. That is usually sorted the same day.

Is Windows LAPS free?

Windows LAPS is built into supported versions of Windows 10 and Windows 11. For management through Microsoft Intune and storage in Microsoft Entra ID you need suitable Microsoft 365 or Intune licences. Floor ICT checks that before the rollout.

What if someone really needs administrator rights for their work?

Then you agree an exception: temporary or for a fixed group, with an owner and an end date. Better a deliberate exception than everyone being administrator by default.

Does Floor ICT do this by default with workplace management?

At intake we propose setting up everyday accounts without administrator rights and switching on Windows LAPS where Windows laptops are under management. Which exceptions you allow stays your decision.

Local admin rights on laptops: why an SME should remove them

If every employee is an administrator on their own laptop, malware installs itself with the same rights. Removing admin rights is boring management — and that is exactly why it works.

Why “everyone is admin” sticks around

It starts out practical: the laptop arrives, a printer driver or accounting tool needs installing quickly, and the easiest route is to make the employee an administrator. After that nobody thinks about it again. The result is an office where every user can install software, pause the antivirus and create local accounts.

That is not only a risk when someone means harm. A phishing attachment or fake update runs with the rights of whoever opens it. If that is a standard user, a lot of malicious software hits a wall. If it is an administrator, the attacker gets the whole laptop straight away — including saved sessions, local files and the ability to cover their tracks.

What you gain

Standard users improve three things. Malware gets less grip. Laptops stay configured the same way, so support can help faster and device compliance and BitLocker are not quietly switched off by a user. And you know which software is actually running, which matters for licensing and for questions from your supply chain, such as NIS2.

The fear is always the same: “then nobody can work.” In practice most employees rarely install anything. What they need can come through a fixed software list or a short ticket route within the same day.

What to sort out this month

Keep the first step small enough to actually carry out:

list who is currently a local administrator, per laptop;
agree a fixed list of standard software rolled out through Microsoft Intune or your administrator;
set up new and rebuilt laptops with a user account without administrator rights by default;
switch on Windows LAPS, so the local administrator account gets a unique password per device, stored in the tenant and rotated automatically;
agree an exception route: who may get temporary administrator rights, for how long, and who approves it.

What not to do on day one: switch every existing laptop at once without a software list, or give developers and technicians the same rules as the finance team without talking about their work. Start with a pilot group, solve the first requests, then roll out more widely.

Windows LAPS: no more shared admin password

Many SME environments have one local administrator password that is the same on every laptop, sometimes for years. If that password leaks on one device, it works on all of them. Windows LAPS fixes this: every device gets its own password, stored in Microsoft Entra ID (formerly Azure Active Directory) and changed after use or on a fixed schedule. Support retrieves it only when it is really needed, and that access is logged.

This belongs with password managers and passkeys: no shared secrets on sticky notes or in a spreadsheet, but a fixed path when someone leaves or a device fails.

How Floor ICT rolls this out — and what you decide

Floor ICT takes stock of current administrator rights, sets up the software list and deployment through Microsoft Intune, switches on Windows LAPS, and moves laptops to standard users in phases. Software requests then go through the ticket portal, so there is a record of what was installed and why.

You decide which roles get an exception, how quickly a software request must be picked up, and whether temporary administrator rights are allowed. Technology without agreements leads to frustrated employees; agreements without technology stay an intention.

More depth

Checklist for SME directors

1) Ask for a list of who is a local administrator. 2) Decide which software is standard. 3) Issue new laptops without administrator rights. 4) Switch on Windows LAPS. 5) Agree an exception route. 6) Move existing laptops over in phases.

The difference with admin accounts in Microsoft 365

Local administrator rights are about one laptop. Admin roles in Microsoft 365 are about the whole environment: users, mail and security settings. Both should be separate from the everyday account, but they are two different measures.

Mac laptops

The same applies on a Mac: a user with administrator rights can change software and settings. Include Macs in the same agreement, managed through Intune or the Mac management you use, instead of leaving them as an exception.

View MSP packages Request an intake Microsoft 365