“Enforce that all users have a standard user account. Administrators across all platforms should log in with their standard accounts as normal practice. They should only log in with administrative rights when they need to perform administrative tasks. This might sound obvious and reasonable but in practice, doesn’t always happen.”