Administrator account
An administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts. Cyber Essentials requires admin accounts to be separate from everyday accounts (A7.6, A7.7), formally approved, tracked and reviewed (A7.5, A7.8, A7.9), and protected by MFA on cloud services (A7.16, an automatic fail if No).
- Term
- Administrator account
- Also known as
- Admin account, Local administrator, Domain administrator, Administrative account
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term administrator account mean in Cyber Essentials?
An administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
How does administrator account apply to Cyber Essentials?
In plain terms
If a normal account is the key to your own office, an administrator account is the master key to the whole building. It can install programs, change security settings and create new accounts. That is useful for whoever runs your IT, and dangerous if a criminal gets hold of it.
What Cyber Essentials asks
The NCSC requirements say admin accounts typically let the user "execute software that can make significant and security-related changes to the operating system", "make changes to the operating system for some or all users" and "create new accounts and allocate privileges". This covers "domain administrators and local administrators". The reason it matters: malware "would typically be executed with the same privilege level" as the account that opened it, so a bad email attachment opened by an admin gets admin powers.
The question set covers admin accounts at A7.5 to A7.9:
- A7.5: a formal process for granting admin access
- A7.6: separate accounts for admin work, covering local, network or domain, and cloud admin accounts
- A7.7: no web browsing or email on admin accounts
- A7.8 and A7.9: a record of who has admin rights, reviewed regularly
A7.16 requires MFA for every administrator of your cloud services. A No to A7.16 is an automatic fail.
What an assessor looks for
Staff whose everyday account is also an administrator. At Cyber Essentials Plus, test case 5 has a standard user try to run an admin task. It passes only if they are prompted for an additional login and the task does not run using their own account details.
See why admin accounts must be separate and CE Plus test 5. Related: standard user account, privileged access, global administrator.
Related terms
- Standard user accountA standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval.
- Privileged accessPrivileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.
- Global administratorA global administrator is the most powerful account in a Microsoft 365 or Microsoft Entra ID setup: it can change every setting, reset any account and add other admins.
- Authenticator appAn authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve.
- BiometricsBiometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password.
- Brute-force attackA brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.
Frequently asked questions
An administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
In the 2026 Danzell question set, administrator account comes up at A7.5, A7.6, A7.7, A7.8, A7.9, A7.16. Read those questions against the definition above so your answers use the term the way the assessor will.
Administrator account relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.